Skip to main content
📤

Data Export Checklist for AI-Built Apps

Let users download their data

When you vibe code data export with tools like Cursor, Lovable, Bolt, v0, or Claude Code, the generated code often works in development but misses critical production requirements. This checklist helps you catch what AI missed before you ship.

Danger Zone

moderate risk

The moment someone requests a data export is when you find out your database can't handle it

Export sounds simple — click a button, download a file. But what happens when someone has 50,000 records? Your server tries to load all of them into memory at once, crashes, and takes down your entire app for everyone. Then there's format handling (Excel expects dates differently than JSON), making sure people can only export their own data, and dealing with exports that take minutes to generate.

Failure scenario

You're six months in with 1,000 users. A power user who's been with you since day one clicks "Export My Data" to back up their work. Your server tries to load their 80,000 records, runs out of memory, and crashes. Your app goes down for 20 minutes while it restarts. Three other users were in the middle of important work. One of them tweets about it.

Common mistakes

  • Loading all export data into memory at once instead of streaming it in chunks
  • No timeout or size limit — a large export can run forever and crash the server
  • Export buttons that trigger synchronously, making the user wait 2 minutes staring at a loading spinner
  • Not checking if the person requesting the export actually owns that data
  • Generating the same export file over and over instead of caching it for a few minutes
  • Dates and numbers formatted for one region but exported to users in another

Time to break: 3-9 months, once someone accumulates enough data

How are you building this?

Showing what to check when using a managed service

Audit Prompts

Copy these into your AI coding assistant to check your implementation.

Can large exports crash your app?
reliability
Check how our export feature handles large amounts of data. When someone clicks export, does it process everything at once or in chunks? Is there a limit on export size? Does the export run in the background (so the user can keep using the app) or does it freeze their browser? If we're using a background job service like Inngest or Trigger.dev, are jobs configured with timeouts and memory limits?

A single large export can bring down your entire app for everyone. Background processing keeps your app responsive and limits the blast radius.

Can people export data that isn't theirs?
security
Test the export feature with different user accounts. Can you export another user's data by changing an ID in the URL or request? Are multi-user workspaces handled correctly — can team members export team data but not other teams' data? Is there logging of who exported what and when?

Export is one of the easiest ways to accidentally leak data. Someone figures out they can change a number in the URL and suddenly they're downloading everyone's information.

Do exported files actually work?
data
Download exports in each format we offer (CSV, JSON, Excel, etc.) and try opening them in the relevant programs. Do dates show up correctly? Do numbers lose precision or get formatted weirdly? Do column headers make sense? Are special characters (like commas in CSV files or quotes) handled correctly? Can the exported data be re-imported if needed?

An export file that can't be opened or has scrambled data is worse than no export at all. You'll get support emails and lose trust.

What happens when exports take a long time?
performance
Test what happens when an export takes more than 30 seconds to generate. Does the user get any feedback? Can they navigate away and get notified when it's ready? If they click export twice, does it create two jobs or recognize it's already running? Is there a way to cancel a running export?

Large exports can take minutes. If users don't know what's happening, they'll click the button five more times and make things worse.

Checklist

0/9 completed

Smart Move

It depends

For small amounts of data (under 10,000 records), building export is straightforward. But if exports can get large or take more than a few seconds, you need background processing. At that point, a background job service (Inngest, Trigger.dev) handles the hard parts — queuing, retries, timeouts — for less than building it yourself.

Inngest

Background job runner — queue export jobs, handle large datasets in chunks, notify users when done

Up to 1,000 jobs per month free

Trigger.dev

Similar to Inngest but with better real-time progress tracking for long exports

Free tier includes basic background jobs

Retool

Build internal admin tools including custom exports — useful if you need other admin features anyway

Free for personal/hobby projects

Tradeoffs

Background services add complexity and a monthly bill at scale, but they keep large exports from crashing your app. For small apps with small exports, a simple synchronous download is fine.

Did you know?

Under GDPR and similar privacy laws, you must provide a user's data in a portable format within 30 days of request — and if you can't, fines start at 2% of global revenue.

Source: EU General Data Protection Regulation Article 20

Related Checks

🔐Authentication

Sign up, log in, password reset, 2FA

⚙️Background Tasks

Process things without making users wait

💳Payments

One-time and recurring charges