How report exports work
This page explains how MapleGather handles report exports — the two delivery paths (immediate vs. queued), how CSV and Excel files are protected against formula injection, and how board members get aggregate-only exports.
The short version
Section titled “The short version”Reports with 1,000 rows or fewer download immediately. Larger reports are queued and delivered by email — but they’re always available in Your exports in case the email is delayed. CSV and Excel exports automatically escape cells that start with =, +, -, or @ to prevent spreadsheet formula injection.
How it works
Section titled “How it works”Sync vs. async export paths
Section titled “Sync vs. async export paths”When you select Export, MapleGather checks the size of your current result set:
1,000 rows or fewer (sync): The file is ready immediately and downloads to your browser. You’ll see the download confirmation in the export dialog.
More than 1,000 rows (async): MapleGather queues the export. The export dialog shows: “Export queued — we’ll email a download link to {email} when it’s ready. It will also appear in Your exports.” You’ll receive an email with a download link when the export finishes, but don’t depend solely on the email. The download is always available at Your exports (in the admin sidebar). Email can be delayed or filtered to spam; Your exports is the reliable path.
If an async export fails on the server side, the entry in Your exports shows “failed” with the reason, and the email notifies you with a retry link — you’re never left with silence.
CSV and Excel injection escaping
Section titled “CSV and Excel injection escaping”Spreadsheet applications treat cells that start with =, +, -, or @ as formulas unless they’re escaped. MapleGather automatically escapes these cells before export.
After an export that includes escaped cells, the dialog shows: “N cells escaped — review before pasting into a formula-aware sheet.” The count is always visible — you know exactly how many cells were affected. If 0 cells needed escaping, no notice appears.
Excel exports also preserve correct data types: dates remain dates, numbers remain numbers, and text remains text. This matters for financial data you’ll use in further calculations.
PDF exports
Section titled “PDF exports”PDF exports render with your organization’s branding in the header, the report name, the period covered, a timestamp of when the export was generated, and a per-page footer. PDF exports are not formula-aware, so injection escaping doesn’t apply.
PDFs are useful as archival copies — for example, keeping a record of the exact figures presented at a board meeting.
Column selection
Section titled “Column selection”Before every export, the dialog shows a column checklist. Columns currently visible in your report are checked by default. Uncheck any column to leave it out. At least one column must remain selected before you can export.
Board exports and PII columns
Section titled “Board exports and PII columns”Board member exports are always aggregate-only. Per-member columns (names, emails, individual payment amounts) never appear in the column selector for a board member, and never appear in the output. The file name includes “Aggregate” and “Board View” to make this explicit.
Admins who don’t have the per-member export permission see a note — “Member detail columns are hidden for your role” — but the rest of the report data is still exported. If a request for PII columns arrives without the right permission, the server omits those columns, notes them in the export’s omitted-columns section, and records an audit entry.
Why it works this way
Section titled “Why it works this way”The 1,000-row async threshold exists because large exports can take longer than a browser request can stay open. Queuing lets the server process large datasets reliably without timing out. Your exports exists because a transactional email is not a reliable delivery channel — it can be delayed, filtered, or lost. Load-bearing data retrieval needs an always-available in-app path.
Injection escaping exists because formula injection is a real attack vector when exported data is pasted into spreadsheets. Making the escape visible (rather than silent) lets you review the affected cells and decide whether the original value needs to be handled differently.
Edge cases & boundaries
Section titled “Edge cases & boundaries”- The Export button is not visible if your role doesn’t include export permissions. The dialog never opens.
- Board members can export from the Board portal. Their exports are always aggregate-only and sync (aggregate summaries have far fewer than 1,000 rows).
- The async email link is valid for 24 hours. Your exports remains accessible as long as the export job exists.