---
title: "Move the database"
description: "Back up the AppSec Portal database, restore it, or move an installation to a new server."
url: https://whitespots.io/docs/appsec-portal/get-started/move-database
slug: appsec-portal/get-started/move-database
publish_date: 2026-10-30T19:42:15.000Z
last_modified: 2026-10-30T19:42:15.000Z
---

# Move the database

Everything Portal knows is in its PostgreSQL database, except uploaded files,
which are in the `media` folder. To move an installation, copy both and keep the signing keys.

## Keep the signing keys

Portal encrypts the credentials you save in integrations (tokens, passwords,
certificates) with its signing keys. A database restored next to different keys still works,
but those credentials can't be read, and you have to enter them again.

- **Docker Compose**: the keys are `JWT_PRIVATE_KEY`, `JWT_PUBLIC_KEY` and `SECRET_KEY` in `.env`.
  Copy `.env` and `.compose-config.sh` to the new server instead of running the installer there.
- **Helm**: the keys are in `secrets.yaml`. Install on the new cluster with the same file.

## Back up

### Docker Compose

In the install folder, with Portal running, open `sh launcher.sh` and choose
**Backup**. The database dump is saved to `backups/`. It works with your own PostgreSQL server
too, if `pg_dump` is installed on the server. Then back up the uploaded files:

```bash verify
tar czf media.tar.gz -C back/AppSecPortal media
```

To back up the database every night, add `backup-postgres.sh` to cron. It keeps the last two
dumps (set `KEEP` to keep more):

```
0 3 * * * /opt/portal/backup-postgres.sh
```

Replace `/opt/portal` with your install folder.

### Helm

With the bundled PostgreSQL:

```bash verify
kubectl exec -n portal portal-postgres-0 -- \
  sh -c 'PGPASSWORD="$POSTGRES_PASSWORD" pg_dump -U "$POSTGRES_USER" "$POSTGRES_DATABASE"' \
  | gzip > portal.sql.gz
```

With your own PostgreSQL server, back it up the way you back up your other databases.

## Restore

Restore into the same release you backed up, then [update](https://whitespots.io/docs/appsec-portal/get-started/update) if you need a newer one.

### Docker Compose

1. On the new server, download the install files as in [Install](https://whitespots.io/docs/appsec-portal/get-started/install), put the `.env`
   and `.compose-config.sh` you copied into the folder, and start it with `sh run.sh`. Don't run
   the launcher before the files are in place: without `.env`, it starts a new install.
2. Stop everything except the database, and empty it:

   ```bash verify
   . ./.compose-config.sh
   compose stop
   compose start postgres
   compose exec -T postgres sh -c 'dropdb -U "$POSTGRES_USER" "$POSTGRES_DB" && createdb -U "$POSTGRES_USER" "$POSTGRES_DB"'
   ```

3. Load the backup and the uploaded files, then start everything:

   ```bash verify
   gunzip -c portal.sql.gz | compose exec -T postgres sh -c 'psql -q -U "$POSTGRES_USER" "$POSTGRES_DB"'
   tar xzf media.tar.gz -C back/AppSecPortal
   compose start
   ```

   A dump from **Backup** is in `backups/`, named `portal_<date>_<time>.sql.gz`.

Log in with the users of the old installation. The license moves with the database.

### Helm

1. Install on the new cluster with the same `values.yaml` and `secrets.yaml`.
2. Stop the pods that use the database:

   ```bash
   kubectl scale deployment -n portal --replicas=0 --all
   ```

3. Empty the database and load the backup:

   ```bash
   kubectl exec -n portal portal-postgres-0 -- sh -c \
     'export PGPASSWORD="$POSTGRES_PASSWORD"; dropdb -U "$POSTGRES_USER" "$POSTGRES_DATABASE" && createdb -U "$POSTGRES_USER" "$POSTGRES_DATABASE"'
   gunzip -c portal.sql.gz | kubectl exec -i -n portal portal-postgres-0 -- \
     sh -c 'PGPASSWORD="$POSTGRES_PASSWORD" psql -q -U "$POSTGRES_USER" "$POSTGRES_DATABASE"'
   ```

4. Start the pods again with the same `helm upgrade` command you installed with.

---

## Navigation

- Location: [Docs](https://whitespots.io/docs) > [Application Security Portal](https://whitespots.io/docs/appsec-portal) > [Get started](https://whitespots.io/docs/appsec-portal/get-started)
- Previous: [Update](https://whitespots.io/docs/appsec-portal/get-started/update)
- Next: [Migrate from DefectDojo](https://whitespots.io/docs/appsec-portal/get-started/migrate-from-defectdojo)