diff --git a/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ExportProjectModal.svelte b/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ExportProjectModal.svelte
index 379ae3c6712..714a9caf211 100644
--- a/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ExportProjectModal.svelte
+++ b/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ExportProjectModal.svelte
@@ -1,10 +1,16 @@
 <script lang="ts">
-  import { Body, Input, ModalContent, Select, Toggle } from "@budibase/bbui"
-  import type { ProjectResponse } from "@budibase/types"
+  import {
+    Body,
+    InlineAlert,
+    Input,
+    ModalContent,
+    Select,
+    Toggle,
+  } from "@budibase/bbui"
+  import type { ExportProjectRequest, ProjectResponse } from "@budibase/types"
 
-  interface ConfirmPayload {
+  interface ConfirmPayload extends ExportProjectRequest {
     id: string
-    encryptPassword?: string
   }
 
   interface Props {
@@ -22,6 +28,7 @@
   }: Props = $props()
 
   let projectId = $state("")
+  let includeRows = $state(false)
   let encrypted = $state(false)
   let encryptPassword = $state("")
   let projectIsEmpty = $derived(
@@ -66,12 +73,12 @@
   onConfirm={() =>
     onConfirm({
       id: projectId,
+      includeRows,
       encryptPassword: encrypted ? encryptPassword.trim() : undefined,
     })}
 >
   <Body size="S">
-    Export a portable Project package for use in another workspace. Rows and
-    attachments are not included yet.
+    Export a portable Project package for use in another workspace.
   </Body>
 
   <Select
@@ -83,6 +90,12 @@
     getOptionColour={project => project.color}
   />
 
+  <Toggle text="Include rows and attachments" bind:value={includeRows} />
+  <Body size="S">
+    Includes all rows from included Budibase DB tables, including shared tables,
+    and their referenced attachments.
+  </Body>
+
   <Toggle text="Encrypt export" bind:value={encrypted} />
 
   {#if encrypted}
@@ -93,5 +106,8 @@
       autocomplete="new-password"
       bind:value={encryptPassword}
     />
+    {#if includeRows}
+      <InlineAlert header="Attachments are not encrypted in the export." />
+    {/if}
   {/if}
 </ModalContent>
diff --git a/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ImportProjectResultModal.spec.ts b/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ImportProjectResultModal.spec.ts
index d3bf095f070..2028d681007 100644
--- a/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ImportProjectResultModal.spec.ts
+++ b/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ImportProjectResultModal.spec.ts
@@ -14,7 +14,7 @@ vi.mock("@budibase/bbui", () => ({
 import ImportProjectResultModal from "./ImportProjectResultModal.svelte"
 
 describe("ImportProjectResultModal", () => {
-  it("groups setup reasons by resource and explains omitted content", async () => {
+  it("groups setup reasons by resource and shows omitted content and data counts", async () => {
     const response: ImportProjectResponse = {
       project: {
         _id: "project_1",
@@ -24,6 +24,7 @@ describe("ImportProjectResultModal", () => {
         updatedAt: "2026-01-01T00:00:00.000Z",
       },
       resources: { [ResourceType.AGENT]: ["agent_1"] },
+      dataImport: { tables: 2, rows: 3, relationships: 1, attachments: 1 },
       requirements: [
         {
           type: "agent_secrets",
@@ -58,6 +59,11 @@ describe("ImportProjectResultModal", () => {
     expect(screen.getByText("Choose an AI model.")).toBeTruthy()
     expect(screen.getByText(response.unsupportedContent[0].reason)).toBeTruthy()
     expect(screen.queryByText(/agent_linked_content/)).toBeNull()
+    expect(
+      screen.getByText(
+        "Tables: 2 · Rows: 3 · Relationships: 1 · Attachments: 1"
+      )
+    ).toBeTruthy()
 
     await fireEvent.click(buttons[0])
     expect(onOpenResource).toHaveBeenCalledExactlyOnceWith(
diff --git a/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ImportProjectResultModal.svelte b/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ImportProjectResultModal.svelte
index bbc72bdd942..17a29d8d6e7 100644
--- a/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ImportProjectResultModal.svelte
+++ b/packages/builder/src/pages/builder/workspace/[workspaceId]/home/_components/ImportProjectResultModal.svelte
@@ -33,6 +33,15 @@
     publishing the imported resources.
   </Body>
 
+  {#if response.dataImport}
+    <Body size="S">
+      Tables: {response.dataImport.tables.toLocaleString()} · Rows: {response.dataImport.rows.toLocaleString()}
+      · Relationships:
+      {response.dataImport.relationships.toLocaleString()} · Attachments:
+      {response.dataImport.attachments.toLocaleString()}
+    </Body>
+  {/if}
+
   <div class="import-details">
     {#if resourceRequirements.length}
       <section>
diff --git a/packages/builder/src/pages/builder/workspace/[workspaceId]/home/index.svelte b/packages/builder/src/pages/builder/workspace/[workspaceId]/home/index.svelte
index 4b74cb6fdb3..a73fedf229a 100644
--- a/packages/builder/src/pages/builder/workspace/[workspaceId]/home/index.svelte
+++ b/packages/builder/src/pages/builder/workspace/[workspaceId]/home/index.svelte
@@ -61,6 +61,7 @@
     type ProjectResponse,
     type ImportProjectResponse,
     type ProjectImportRequirement,
+    type ExportProjectRequest,
     PublishResourceState,
     type Agent,
     type Table,
@@ -490,12 +491,10 @@
   const handleExportProject = async ({
     id,
     encryptPassword,
-  }: {
-    id: string
-    encryptPassword?: string
-  }) => {
+    includeRows,
+  }: ExportProjectRequest & { id: string }) => {
     try {
-      await projectsStore.exportProject(id, { encryptPassword })
+      await projectsStore.exportProject({ id, encryptPassword, includeRows })
       exportProjectModal?.hide()
     } catch (error) {
       console.error(error)
@@ -550,7 +549,11 @@
           "Project imported, but some resources could not be refreshed. Reload the workspace to see all imported resources."
         )
       }
-      if (response.requirements.length || response.unsupportedContent.length) {
+      if (
+        response.requirements.length ||
+        response.unsupportedContent.length ||
+        response.dataImport
+      ) {
         importProjectResultModal?.show()
       }
     } catch (error) {
diff --git a/packages/builder/src/stores/portal/projects.ts b/packages/builder/src/stores/portal/projects.ts
index 39ff2ab8fcb..8846e590343 100644
--- a/packages/builder/src/stores/portal/projects.ts
+++ b/packages/builder/src/stores/portal/projects.ts
@@ -2,6 +2,7 @@ import { API } from "@/api"
 import { downloadStream } from "@budibase/frontend-core"
 import type {
   CreateProjectRequest,
+  ExportProjectRequest,
   ImportProjectRequest,
   ImportProjectResponse,
   PreviewProjectAssignmentRequest,
@@ -86,12 +87,10 @@ export class ProjectsStore extends BudiStore<ProjectResponse[]> {
     return response.project
   }
 
-  exportProject = async (
-    id: string,
-    body?: {
-      encryptPassword?: string
-    }
-  ) => {
+  exportProject = async ({
+    id,
+    ...body
+  }: ExportProjectRequest & { id: string }) => {
     const response = await API.projects.exportBundle(id, body)
     await downloadStream(response)
   }
diff --git a/packages/server/src/api/controllers/project.ts b/packages/server/src/api/controllers/project.ts
index a23b92d9d71..af90cbdefcd 100644
--- a/packages/server/src/api/controllers/project.ts
+++ b/packages/server/src/api/controllers/project.ts
@@ -203,6 +203,7 @@ export async function exportBundle(
   const exportStream = await sdk.projects.streamExportProject({
     projectId: id,
     encryptPassword,
+    includeRows: ctx.request.body?.includeRows,
   })
   ctx.attachment(identifier)
   ctx.body = exportStream
diff --git a/packages/server/src/api/routes/project.ts b/packages/server/src/api/routes/project.ts
index b0ad70ba93e..1227df7e58d 100644
--- a/packages/server/src/api/routes/project.ts
+++ b/packages/server/src/api/routes/project.ts
@@ -63,6 +63,7 @@ builderRoutes
     middleware.joiValidator.body(
       Joi.object({
         encryptPassword: Joi.string().max(1024).optional().allow(""),
+        includeRows: Joi.boolean().strict().optional(),
       }),
       {
         allowUnknown: false,
diff --git a/packages/server/src/api/routes/tests/projectData.spec.ts b/packages/server/src/api/routes/tests/projectData.spec.ts
new file mode 100644
index 00000000000..c60d95092c2
--- /dev/null
+++ b/packages/server/src/api/routes/tests/projectData.spec.ts
@@ -0,0 +1,646 @@
+import { context, db, features, objectStore } from "@budibase/backend-core"
+import { DatabaseImpl } from "../../../../../backend-core/src/db/couch/DatabaseImpl"
+import { mocks } from "@budibase/backend-core/tests"
+import { quotas } from "@budibase/pro"
+import { Header } from "@budibase/shared-core"
+import {
+  AutoFieldSubType,
+  FeatureFlag,
+  FieldType,
+  QuotaUsageType,
+  RelationshipType,
+  StaticQuotaName,
+  type ExportProjectRequest,
+  type ImportProjectRequest,
+  type ImportProjectResponse,
+  type Row,
+  type RowAttachment,
+} from "@budibase/types"
+import { Readable } from "stream"
+import { buffer } from "stream/consumers"
+import cloneDeep from "lodash/cloneDeep"
+import { ObjectStoreBuckets } from "../../../constants"
+import BudibaseEmitter from "../../../events/BudibaseEmitter"
+import * as projectLock from "../../../sdk/workspace/projects/lock"
+import TestConfiguration from "../../../tests/utilities/TestConfiguration"
+import { basicTable } from "../../../tests/utilities/structures"
+
+jest.mock("../../../sdk/workspace/projects/lock", () => {
+  const actual = jest.requireActual<
+    typeof import("../../../sdk/workspace/projects/lock")
+  >("../../../sdk/workspace/projects/lock")
+  return {
+    ...actual,
+    doWithProjectAssignmentsLock: jest.fn(actual.doWithProjectAssignmentsLock),
+  }
+})
+
+describe("Project data export and import", () => {
+  const config = new TestConfiguration()
+  const attachmentContent = Buffer.from("Instructions for the sample task")
+
+  const withProjectsEnabled = async <T>(task: () => Promise<T>) =>
+    await features.testutils.withFeatureFlags(
+      config.getTenantId(),
+      { [FeatureFlag.PROJECTS]: true },
+      task
+    )
+
+  beforeEach(async () => {
+    mocks.licenses.useUnlimited()
+    await config.newTenant()
+  })
+
+  afterEach(() => {
+    mocks.licenses.useUnlimited()
+  })
+
+  afterAll(() => config.end())
+
+  it("rejects a string data-export toggle", async () => {
+    await withProjectsEnabled(async () => {
+      const { project } = await config.api.project.create({ name: "Tasks" })
+      await config
+        .request!.post(`/api/projects/${project._id}/export`)
+        .set(config.defaultHeaders())
+        .send({ includeRows: "false" })
+        .expect(400)
+    })
+  })
+
+  const createDataProject = async () => {
+    const { project } = await config.api.project.create({ name: "Tasks" })
+    const { project: sharedProject } = await config.api.project.create({
+      name: "Shared categories",
+    })
+    const categories = await config.api.table.save(
+      basicTable(undefined, {
+        name: "Categories",
+        projectIds: [project._id, sharedProject._id],
+      })
+    )
+    const tasks = await config.api.table.save(
+      basicTable(undefined, {
+        name: "Tasks",
+        projectIds: [project._id],
+        schema: {
+          category: {
+            name: "category",
+            type: FieldType.LINK,
+            tableId: categories._id!,
+            fieldName: "tasks",
+            relationshipType: RelationshipType.MANY_TO_MANY,
+          },
+          attachment: {
+            name: "attachment",
+            type: FieldType.ATTACHMENT_SINGLE,
+          },
+          gallery: { name: "gallery", type: FieldType.ATTACHMENTS },
+          autoId: {
+            name: "autoId",
+            type: FieldType.NUMBER,
+            subtype: AutoFieldSubType.AUTO_ID,
+            autocolumn: true,
+          },
+        },
+      })
+    )
+
+    const attachment: RowAttachment = {
+      key: `${config.getProdWorkspaceId()}/attachments/instructions.txt`,
+      name: "instructions.txt",
+      extension: "txt",
+      size: attachmentContent.length,
+    }
+    await objectStore.streamUpload({
+      bucket: ObjectStoreBuckets.APPS,
+      filename: attachment.key!,
+      stream: Readable.from(attachmentContent),
+      type: "text/plain",
+    })
+    const category = await config.api.row.save(categories._id!, {
+      name: "Open",
+    })
+    await config.api.row.save(categories._id!, { name: "Closed" })
+    const description = `Sample content referencing ${tasks._id}`
+    const task = await config.api.row.save(tasks._id!, {
+      name: "First task",
+      description,
+      category: [category._id!],
+      attachment,
+      gallery: [attachment],
+    })
+    await config.doInContext(undefined, async () => {
+      const db = context.getWorkspaceDB()
+      const stored = await db.get<Row>(task._id!)
+      await db.put({ ...stored, autoId: 42 })
+    })
+
+    const excludedTable = await config.api.table.save(
+      basicTable(undefined, { name: "Unrelated records" })
+    )
+    await config.api.row.save(excludedTable._id!, { name: "Private record" })
+    await objectStore.streamUpload({
+      bucket: ObjectStoreBuckets.APPS,
+      filename: `${config.getProdWorkspaceId()}/attachments/unreferenced.txt`,
+      stream: Readable.from("Unreferenced attachment"),
+      type: "text/plain",
+    })
+
+    return {
+      project,
+      tasks,
+      task,
+      categories,
+      category,
+      attachment,
+      description,
+    }
+  }
+
+  const createProjectDataArchive = async ({
+    options = {},
+  }: { options?: ExportProjectRequest } = {}) => {
+    const source = await createDataProject()
+    const archive = await config.api.project.export(source.project._id, {
+      includeRows: true,
+      ...options,
+    })
+    return { source, archive }
+  }
+
+  const getRowUsage = async (workspaceId: string) =>
+    await config.doInContext(workspaceId, () =>
+      quotas.getCurrentUsageValues(QuotaUsageType.STATIC, StaticQuotaName.ROWS)
+    )
+
+  const readImportedData = async (imported: ImportProjectResponse) => {
+    const tables = (await config.api.table.fetch()).filter(table =>
+      imported.resources.table?.includes(table._id!)
+    )
+    const tasks = tables.find(table => table.name === "Tasks")!
+    const categories = tables.find(table => table.name === "Categories")!
+    const rows = await config.api.row.fetch(tasks._id!)
+    const categoryRows = await config.api.row.fetch(categories._id!)
+    return { tasks, categories, rows, categoryRows }
+  }
+
+  it("leaves tables empty when data is not requested", async () => {
+    await withProjectsEnabled(async () => {
+      const source = await createDataProject()
+      const archive = await config.api.project.export(source.project._id)
+      const imported = await config.api.project.import(archive)
+      const data = await readImportedData(imported)
+
+      expect(data.rows).toEqual([])
+      expect(data.categoryRows).toEqual([])
+      expect(imported.resources.table).toHaveLength(2)
+      expect(await config.api.row.fetch(source.tasks._id!)).toEqual([
+        expect.objectContaining({ _id: source.task._id, autoId: 42 }),
+      ])
+    })
+  })
+
+  const importProjectData = async ({
+    archive,
+    options,
+  }: {
+    archive: Buffer
+    options: ImportProjectRequest
+  }) => {
+    const response = await config.api.project.import(archive, options)
+    return { response, ...(await readImportedData(response)) }
+  }
+
+  const packageFormats = [
+    { format: "unencrypted", options: {} },
+    { format: "encrypted", options: { encryptPassword: "example-password" } },
+  ]
+
+  const readAttachmentContent = async (attachment: RowAttachment) => {
+    const { stream } = await objectStore.getReadStream(
+      ObjectStoreBuckets.APPS,
+      attachment.key!
+    )
+    return await buffer(stream)
+  }
+
+  it.each(packageFormats)(
+    "imports related rows and attachment content from an $format package",
+    async ({ options }) => {
+      await withProjectsEnabled(async () => {
+        const { source, archive } = await createProjectDataArchive({ options })
+        const destination = await config.api.workspace.create({
+          name: "Destination",
+        })
+        await config.withHeaders(
+          { [Header.WORKSPACE_ID]: destination.appId },
+          async () => {
+            const imported = await importProjectData({ archive, options })
+            const openCategory = imported.categoryRows.find(
+              row => row.name === "Open"
+            )!
+            const attachment: RowAttachment = imported.rows[0].attachment
+
+            expect(imported.response.dataImport).toEqual({
+              tables: 2,
+              rows: 3,
+              relationships: 1,
+              attachments: 1,
+            })
+            expect(imported.rows).toEqual([
+              expect.objectContaining({
+                name: "First task",
+                description: source.description,
+                autoId: 42,
+                tableId: imported.tasks._id,
+                category: [expect.objectContaining({ _id: openCategory._id })],
+                attachment: expect.objectContaining({
+                  name: source.attachment.name,
+                  size: attachmentContent.length,
+                }),
+                gallery: [expect.objectContaining({ key: attachment.key })],
+              }),
+            ])
+            expect(imported.categoryRows.map(row => row.name).sort()).toEqual([
+              "Closed",
+              "Open",
+            ])
+            expect(openCategory.tasks).toEqual([
+              expect.objectContaining({ _id: imported.rows[0]._id }),
+            ])
+            expect(attachment.key).not.toBe(source.attachment.key)
+            expect(await readAttachmentContent(attachment)).toEqual(
+              attachmentContent
+            )
+          }
+        )
+      })
+    }
+  )
+
+  it("omits relationships to data outside the Project and reports the omission", async () => {
+    await withProjectsEnabled(async () => {
+      const source = await createDataProject()
+      const preview = await config.api.project.previewAssignment({
+        resourceId: source.categories._id!,
+        projectIds: [],
+      })
+      await config.api.project.updateAssignment(source.categories._id!, {
+        resourceRev: preview.resourceRev,
+        dependencyFingerprint: preview.dependencyFingerprint,
+        projectIds: [],
+        dependencyIds: [],
+      })
+      const archive = await config.api.project.export(source.project._id, {
+        includeRows: true,
+      })
+      const destination = await config.api.workspace.create({
+        name: "Destination",
+      })
+
+      await config.withHeaders(
+        { [Header.WORKSPACE_ID]: destination.appId },
+        async () => {
+          const imported = await config.api.project.import(archive)
+          const tasks = await config.api.table.get(imported.resources.table![0])
+          const rows = await config.api.row.fetch(tasks._id!)
+
+          expect(imported.resources.table).toHaveLength(1)
+          expect(tasks.name).toBe("Tasks")
+          expect(rows).toHaveLength(1)
+          expect(rows[0]).not.toHaveProperty("category")
+          expect(await readAttachmentContent(rows[0].attachment)).toEqual(
+            attachmentContent
+          )
+          expect(imported.dataImport).toEqual({
+            tables: 1,
+            rows: 1,
+            relationships: 0,
+            attachments: 1,
+          })
+          expect(imported.unsupportedContent).toContainEqual({
+            type: "excluded_row_relationship",
+            count: 1,
+            reason:
+              "Row relationships to data outside this Project were omitted.",
+          })
+        }
+      )
+    })
+  })
+
+  it("re-imports independently, preserving existing data and counting new rows without triggering automations", async () => {
+    await withProjectsEnabled(async () => {
+      const { source, archive } = await createProjectDataArchive()
+      const destination = await config.api.workspace.create({
+        name: "Destination",
+      })
+      await config.withHeaders(
+        { [Header.WORKSPACE_ID]: destination.appId },
+        async () => {
+          const existing = await config.api.table.save(
+            basicTable(undefined, { name: "Existing table" })
+          )
+          const existingRow = await config.api.row.save(existing._id!, {
+            name: "Keep me",
+          })
+          const usageBefore = await getRowUsage(destination.appId)
+          const emitRow = jest.spyOn(BudibaseEmitter.prototype, "emitRow")
+          try {
+            const firstImport = await importProjectData({
+              archive,
+              options: {},
+            })
+            const secondImport = await importProjectData({
+              archive,
+              options: {},
+            })
+            const firstOpenCategory = firstImport.categoryRows.find(
+              row => row.name === "Open"
+            )!
+            const secondOpenCategory = secondImport.categoryRows.find(
+              row => row.name === "Open"
+            )!
+            const firstAttachment: RowAttachment =
+              firstImport.rows[0].attachment
+            const secondAttachment: RowAttachment =
+              secondImport.rows[0].attachment
+            const usageAfter = await getRowUsage(destination.appId)
+
+            expect(
+              new Set([
+                source.tasks._id,
+                firstImport.tasks._id,
+                secondImport.tasks._id,
+              ]).size
+            ).toBe(3)
+            expect(
+              new Set([
+                source.task._id,
+                firstImport.rows[0]._id,
+                secondImport.rows[0]._id,
+              ]).size
+            ).toBe(3)
+            expect(
+              new Set([
+                source.categories._id,
+                firstImport.categories._id,
+                secondImport.categories._id,
+              ]).size
+            ).toBe(3)
+            expect(
+              new Set([
+                source.category._id,
+                firstOpenCategory._id,
+                secondOpenCategory._id,
+              ]).size
+            ).toBe(3)
+            expect(firstImport.rows[0].category).toEqual([
+              expect.objectContaining({ _id: firstOpenCategory._id }),
+            ])
+            expect(secondImport.rows[0].category).toEqual([
+              expect.objectContaining({ _id: secondOpenCategory._id }),
+            ])
+            expect(firstOpenCategory.tasks).toEqual([
+              expect.objectContaining({ _id: firstImport.rows[0]._id }),
+            ])
+            expect(secondOpenCategory.tasks).toEqual([
+              expect.objectContaining({ _id: secondImport.rows[0]._id }),
+            ])
+            expect(firstAttachment.key).not.toBe(source.attachment.key)
+            expect(secondAttachment.key).not.toBe(source.attachment.key)
+            expect(firstAttachment.key).not.toBe(secondAttachment.key)
+            expect(await readAttachmentContent(firstAttachment)).toEqual(
+              attachmentContent
+            )
+            expect(await readAttachmentContent(secondAttachment)).toEqual(
+              attachmentContent
+            )
+            expect(await config.api.row.fetch(existing._id!)).toEqual([
+              expect.objectContaining({
+                _id: existingRow._id,
+                name: "Keep me",
+              }),
+            ])
+            expect(emitRow).not.toHaveBeenCalled()
+            expect(usageAfter.total - usageBefore.total).toBe(6)
+            expect(usageAfter.app! - usageBefore.app!).toBe(6)
+          } finally {
+            emitRow.mockRestore()
+          }
+        }
+      )
+    })
+  })
+
+  it("allocates the next Auto ID above imported values", async () => {
+    await withProjectsEnabled(async () => {
+      const { archive } = await createProjectDataArchive()
+      const imported = await config.api.project.import(archive)
+      const data = await readImportedData(imported)
+      const next = await config.api.row.save(data.tasks._id!, {
+        name: "Next task",
+      })
+
+      expect(next.autoId).toBe(43)
+    })
+  })
+
+  const createDestination = async () => {
+    const destination = await config.api.workspace.create({
+      name: "Existing destination",
+    })
+    await config.withHeaders(
+      { [Header.WORKSPACE_ID]: destination.appId },
+      async () => {
+        const { project } = await config.api.project.create({
+          name: "Existing project",
+        })
+        const table = await config.api.table.save(
+          basicTable(undefined, {
+            name: "Existing table",
+            projectIds: [project._id],
+          })
+        )
+        await config.api.row.save(table._id!, { name: "Keep this record" })
+        await objectStore.streamUpload({
+          bucket: ObjectStoreBuckets.APPS,
+          filename: `${db.getProdWorkspaceID(destination.appId)}/attachments/existing.txt`,
+          stream: Readable.from("Keep this attachment"),
+          type: "text/plain",
+        })
+      }
+    )
+    return destination
+  }
+
+  const snapshotWorkspace = async (workspaceId: string) =>
+    await config.doInContext(workspaceId, async () => ({
+      documents: (
+        await context.getWorkspaceDB().allDocs({ include_docs: true })
+      ).rows.map(({ doc }) => doc),
+      attachmentKeys: Object.keys(
+        await objectStore.getAllFiles(
+          ObjectStoreBuckets.APPS,
+          `${db.getProdWorkspaceID(workspaceId)}/attachments/`
+        )
+      ).sort(),
+      rowUsage: await quotas.getCurrentUsageValues(
+        QuotaUsageType.STATIC,
+        StaticQuotaName.ROWS
+      ),
+    }))
+
+  const failRowImportAfterFirstWrite = ({
+    workspaceId,
+  }: {
+    workspaceId: string
+  }) => {
+    const originalBulkDocs = DatabaseImpl.prototype.bulkDocs
+    return jest
+      .spyOn(DatabaseImpl.prototype, "bulkDocs")
+      .mockImplementation(async function (this: DatabaseImpl, docs) {
+        if (
+          context.getWorkspaceId() === workspaceId &&
+          docs.some(doc => doc._id?.startsWith("ro_") && !doc._deleted)
+        ) {
+          const saved = await this.put(docs[0])
+          return [
+            { id: saved.id, rev: saved.rev },
+            ...docs.slice(1).map(doc => ({
+              id: doc._id!,
+              error: "conflict",
+              reason: "import failed",
+            })),
+          ]
+        }
+        return await originalBulkDocs.call(this, docs)
+      })
+  }
+
+  it("rolls back partial row writes and uploaded attachments without changing existing data", async () => {
+    await withProjectsEnabled(async () => {
+      const { archive } = await createProjectDataArchive()
+      const destination = await createDestination()
+      const before = await snapshotWorkspace(destination.appId)
+      const bulkDocs = failRowImportAfterFirstWrite({
+        workspaceId: destination.appId,
+      })
+      const actualLock = jest.requireActual<
+        typeof import("../../../sdk/workspace/projects/lock")
+      >("../../../sdk/workspace/projects/lock").doWithProjectAssignmentsLock
+      let lockExecutions = 0
+      let activeLock: number | undefined
+      let rollbackLock: number | undefined
+      const assignmentLock = jest
+        .mocked(projectLock.doWithProjectAssignmentsLock)
+        .mockImplementation(async task => {
+          const execution = ++lockExecutions
+          return await actualLock(async () => {
+            activeLock = execution
+            try {
+              return await task()
+            } finally {
+              activeLock = undefined
+            }
+          })
+        })
+      const actualBulkRemove = DatabaseImpl.prototype.bulkRemove
+      const bulkRemove = jest
+        .spyOn(DatabaseImpl.prototype, "bulkRemove")
+        .mockImplementation(async function (this: DatabaseImpl, docs, opts) {
+          rollbackLock = activeLock
+          return await actualBulkRemove.call(this, docs, opts)
+        })
+
+      try {
+        await config.withHeaders(
+          { [Header.WORKSPACE_ID]: destination.appId },
+          async () => {
+            await config.api.project.import(archive, undefined, {
+              status: 400,
+              body: {
+                message: expect.stringContaining(
+                  "Project import failed while saving"
+                ),
+              },
+            })
+          }
+        )
+      } finally {
+        bulkDocs.mockRestore()
+        bulkRemove.mockRestore()
+        assignmentLock.mockImplementation(actualLock)
+      }
+
+      expect(rollbackLock).toBe(1)
+      expect(await snapshotWorkspace(destination.appId)).toEqual(before)
+    })
+  })
+
+  it("preserves completed rows and attachment content if releasing the assignment lock fails", async () => {
+    await withProjectsEnabled(async () => {
+      const { archive } = await createProjectDataArchive()
+      const destination = await config.api.workspace.create({
+        name: "Destination",
+      })
+      const usageBefore = await getRowUsage(destination.appId)
+      const actualLock = jest.requireActual<
+        typeof import("../../../sdk/workspace/projects/lock")
+      >("../../../sdk/workspace/projects/lock").doWithProjectAssignmentsLock
+      const assignmentLock = jest
+        .mocked(projectLock.doWithProjectAssignmentsLock)
+        .mockImplementation(async task => {
+          await actualLock(task)
+          throw new Error("Could not release assignment lock")
+        })
+
+      try {
+        await config.withHeaders(
+          { [Header.WORKSPACE_ID]: destination.appId },
+          async () => {
+            await config.api.project.import(archive, undefined, { status: 500 })
+            const tables = await config.api.table.fetch()
+            const tasks = tables.find(table => table.name === "Tasks")!
+            const rows = await config.api.row.fetch(tasks._id!)
+            const usageAfter = await getRowUsage(destination.appId)
+
+            expect(rows).toHaveLength(1)
+            expect(await readAttachmentContent(rows[0].attachment)).toEqual(
+              attachmentContent
+            )
+            expect(usageAfter.total - usageBefore.total).toBe(3)
+            expect(usageAfter.app! - usageBefore.app!).toBe(3)
+          }
+        )
+      } finally {
+        assignmentLock.mockImplementation(actualLock)
+      }
+    })
+  })
+
+  it("rejects imports exceeding the total row quota without changing the destination", async () => {
+    await withProjectsEnabled(async () => {
+      const { archive } = await createProjectDataArchive()
+      const destination = await createDestination()
+      const before = await snapshotWorkspace(destination.appId)
+      const licence = cloneDeep(mocks.licenses.useUnlimited())
+      licence.quotas.usage.static.rows.value = before.rowUsage.total + 2
+      licence.quotas.usage.static.rows.triggers = []
+      mocks.licenses.useLicense(licence)
+
+      await config.withHeaders(
+        { [Header.WORKSPACE_ID]: destination.appId },
+        async () => {
+          await config.api.project.import(archive, undefined, {
+            status: 400,
+            body: { message: "Usage limit exceeded: 'rows'" },
+          })
+        }
+      )
+
+      expect(await snapshotWorkspace(destination.appId)).toEqual(before)
+    })
+  })
+})
diff --git a/packages/server/src/sdk/workspace/projects/backups/constants.ts b/packages/server/src/sdk/workspace/projects/backups/constants.ts
index 01ec4cf3b19..f60d13f5344 100644
--- a/packages/server/src/sdk/workspace/projects/backups/constants.ts
+++ b/packages/server/src/sdk/workspace/projects/backups/constants.ts
@@ -4,6 +4,7 @@ export const PROJECT_FILE = "project.json"
 export const PROJECT_DEPENDENCY_INDEX_FILE = "dependency-index.json"
 export const PROJECT_DOCS_DIRECTORY = "docs"
 export const PROJECT_ATTACHMENTS_DIRECTORY = "attachments"
+export const PROJECT_DATA_FILE = "data.json"
 export const MAX_PROJECT_ARCHIVE_SIZE_BYTES = 50 * 1024 * 1024
 export const MAX_PROJECT_EXTRACTED_SIZE_BYTES = 100 * 1024 * 1024
 export const MAX_PROJECT_PACKAGE_ENTRIES = 2000
diff --git a/packages/server/src/sdk/workspace/projects/backups/data.spec.ts b/packages/server/src/sdk/workspace/projects/backups/data.spec.ts
new file mode 100644
index 00000000000..3c55b13e81f
--- /dev/null
+++ b/packages/server/src/sdk/workspace/projects/backups/data.spec.ts
@@ -0,0 +1,282 @@
+import { db } from "@budibase/backend-core"
+import {
+  AutoFieldSubType,
+  BBReferenceFieldSubType,
+  FieldType,
+  InternalTable,
+  type ProjectPackageData,
+  RelationshipType,
+} from "@budibase/types"
+import LinkDocumentImpl from "../../../../db/linkedRows/LinkDocument"
+import { basicTable } from "../../../../tests/utilities/structures"
+import { prepareProjectData, validateProjectData } from "./data"
+
+const sourceWorkspaceId = "app_dev_source"
+const sourceKey = "app_source/attachments/example.png"
+const sourceRowId = "ro_ta_source_first"
+const relatedRowId = "ro_ta_related_second"
+
+const fixture = ({ attachmentKey = sourceKey } = {}) => {
+  const sourceTable = basicTable(undefined, {
+    _id: "ta_source",
+    schema: {
+      assignee: {
+        name: "assignee",
+        type: FieldType.BB_REFERENCE_SINGLE,
+        subtype: BBReferenceFieldSubType.USER,
+      },
+      createdBy: {
+        name: "createdBy",
+        type: FieldType.AUTO,
+        autocolumn: true,
+        subtype: AutoFieldSubType.CREATED_BY,
+      },
+      files: { name: "files", type: FieldType.ATTACHMENTS },
+      image: { name: "image", type: FieldType.ATTACHMENT_SINGLE },
+      signature: { name: "signature", type: FieldType.SIGNATURE_SINGLE },
+      related: {
+        name: "related",
+        type: FieldType.LINK,
+        tableId: "ta_related",
+        fieldName: "source",
+        relationshipType: RelationshipType.MANY_TO_MANY,
+      },
+    },
+  })
+  const relatedTable = basicTable(undefined, {
+    _id: "ta_related",
+    schema: {
+      source: {
+        name: "source",
+        type: FieldType.LINK,
+        tableId: "ta_source",
+        fieldName: "related",
+        relationshipType: RelationshipType.MANY_TO_MANY,
+      },
+    },
+  })
+  const attachment = {
+    key: attachmentKey,
+    name: "example.png",
+    extension: "png",
+    size: 10,
+    url: "https://example.com/expired",
+  }
+  const data: ProjectPackageData = {
+    rows: [
+      {
+        _id: sourceRowId,
+        _rev: "1-source",
+        tableId: "ta_source",
+        name: "ta_source",
+        description: `{{ ${sourceRowId}.name }}`,
+        metadata: { table: "ta_source" },
+        assignee: "us_author",
+        createdBy: ["us_author", "us_other"],
+        autoId: 42,
+        createdAt: "2026-01-01T00:00:00.000Z",
+        files: [attachment],
+        image: attachment,
+        signature: attachment,
+      },
+      { _id: relatedRowId, tableId: "ta_related", name: "Related" },
+    ],
+    relationships: [
+      {
+        doc1: {
+          tableId: "ta_source",
+          rowId: sourceRowId,
+          fieldName: "related",
+        },
+        doc2: {
+          tableId: "ta_related",
+          rowId: relatedRowId,
+          fieldName: "source",
+        },
+      },
+    ],
+    attachments: [
+      {
+        key: attachmentKey,
+        path: "attachments/example",
+        contentType: "image/png",
+      },
+    ],
+  }
+  return { tables: [sourceTable, relatedTable], data }
+}
+
+const validate = ({ data, tables }: ReturnType<typeof fixture>) =>
+  validateProjectData({
+    data,
+    tables,
+    sourceWorkspaceId,
+    attachmentPaths: ["attachments/example"],
+  })
+
+describe("Project package data", () => {
+  it("remaps structural references while preserving starter values", () => {
+    const { data, tables } = fixture()
+    const result = prepareProjectData({
+      data: validate({ data, tables }),
+      tables,
+      idMap: new Map([
+        ["ta_source", "ta_destination"],
+        ["ta_related", "ta_other"],
+      ]),
+      workspaceId: "app_dev_destination",
+      userId: db.generateUserMetadataID("us_importer"),
+    })
+    const row = result.rows[0]
+    const key = result.attachments[0].key
+    expect(row).toEqual({
+      ...data.rows[0],
+      _id: expect.stringMatching(/^ro_ta_destination_/),
+      _rev: undefined,
+      tableId: "ta_destination",
+      assignee: "us_importer",
+      createdBy: ["us_importer"],
+      files: [{ key, name: "example.png", extension: "png", size: 10 }],
+      image: { key, name: "example.png", extension: "png", size: 10 },
+      signature: { key, name: "example.png", extension: "png", size: 10 },
+    })
+    expect(result.relationships).toEqual([
+      new LinkDocumentImpl(
+        "ta_destination",
+        "related",
+        row._id!,
+        "ta_other",
+        "source",
+        result.rows[1]._id!
+      ),
+    ])
+    expect(result.summary).toEqual({
+      tables: 2,
+      rows: 2,
+      relationships: 1,
+      attachments: 1,
+    })
+  })
+
+  it("rejects user references without an importing user", () => {
+    const { data, tables } = fixture()
+
+    expect(() =>
+      prepareProjectData({
+        data: validate({ data, tables }),
+        tables,
+        idMap: new Map([
+          ["ta_source", "ta_destination"],
+          ["ta_related", "ta_other"],
+        ]),
+        workspaceId: "app_dev_destination",
+      })
+    ).toThrow("requires an importing user for its user references")
+  })
+
+  it("rejects rows without a destination table mapping", () => {
+    const { data, tables } = fixture()
+
+    expect(() =>
+      prepareProjectData({
+        data: validate({ data, tables }),
+        tables,
+        idMap: new Map(),
+        workspaceId: "app_dev_destination",
+        userId: "us_importer",
+      })
+    ).toThrow("could not map an imported table")
+  })
+
+  it("allocates independent rows and attachments on repeated imports into the source workspace", () => {
+    const { data, tables } = fixture()
+    const prepare = () =>
+      prepareProjectData({
+        data: validate({ data, tables }),
+        tables,
+        idMap: new Map([
+          ["ta_source", "ta_destination"],
+          ["ta_related", "ta_other"],
+        ]),
+        workspaceId: sourceWorkspaceId,
+        userId: "us_importer",
+      })
+    const first = prepare()
+    const second = prepare()
+    expect(first.rows[0]._id).not.toEqual(second.rows[0]._id)
+    expect(first.relationships[0]._id).not.toEqual(second.relationships[0]._id)
+    expect(first.attachments[0].key).not.toEqual(second.attachments[0].key)
+    expect(first.attachments[0].key).not.toEqual(sourceKey)
+  })
+
+  it("rejects duplicate rows", () => {
+    const test = fixture()
+    test.data.rows.push(test.data.rows[0])
+
+    expect(() => validate(test)).toThrow("invalid or duplicate row")
+  })
+
+  it("rejects rows from external tables", () => {
+    const test = fixture()
+    test.tables[0].sourceId = "ds_external"
+
+    expect(() => validate(test)).toThrow("invalid or duplicate row")
+  })
+
+  it("rejects user metadata rows", () => {
+    const userTable = basicTable(undefined, {
+      _id: InternalTable.USER_METADATA,
+    })
+    const data: ProjectPackageData = {
+      rows: [
+        {
+          _id: `ro_${InternalTable.USER_METADATA}_first`,
+          tableId: InternalTable.USER_METADATA,
+        },
+      ],
+      relationships: [],
+      attachments: [],
+    }
+
+    expect(() =>
+      validateProjectData({
+        data,
+        tables: [userTable],
+        sourceWorkspaceId,
+        attachmentPaths: [],
+      })
+    ).toThrow("invalid or duplicate row")
+  })
+
+  it("rejects relationships whose endpoint is not in the package", () => {
+    const test = fixture()
+    test.data.relationships[0].doc2.rowId = "ro_ta_related_missing"
+    expect(() => validate(test)).toThrow("outside its rows or table schema")
+  })
+
+  it("rejects a repeated relationship with its endpoints reversed", () => {
+    const test = fixture()
+    const { doc1, doc2 } = test.data.relationships[0]
+    test.data.relationships.push({ doc1: doc2, doc2: doc1 })
+    expect(() => validate(test)).toThrow("duplicate relationship")
+  })
+
+  it("rejects attachments whose bytes are absent from the package", () => {
+    const { data, tables } = fixture()
+    expect(() =>
+      validateProjectData({
+        data,
+        tables,
+        sourceWorkspaceId,
+        attachmentPaths: [],
+      })
+    ).toThrow("attachments do not match")
+  })
+
+  it("rejects attachment objects belonging to another workspace", () => {
+    const test = fixture({
+      attachmentKey: "app_other/attachments/example.png",
+    })
+    expect(() => validate(test)).toThrow("invalid or unreferenced attachment")
+  })
+})
diff --git a/packages/server/src/sdk/workspace/projects/backups/data.ts b/packages/server/src/sdk/workspace/projects/backups/data.ts
new file mode 100644
index 00000000000..2c851d7cc52
--- /dev/null
+++ b/packages/server/src/sdk/workspace/projects/backups/data.ts
@@ -0,0 +1,512 @@
+import {
+  context,
+  db,
+  HTTPError,
+  objectStore,
+  utils,
+} from "@budibase/backend-core"
+import {
+  AutoFieldSubType,
+  BBReferenceFieldSubType,
+  DocumentType,
+  FieldType,
+  INTERNAL_TABLE_SOURCE_ID,
+  InternalTable,
+  type LinkDocument,
+  type LinkInfo,
+  type ProjectDataImportSummary,
+  type ProjectPackageAttachment,
+  type ProjectPackageData,
+  type ProjectPackageRelationship,
+  type ProjectPackageUnsupportedContent,
+  type Row,
+  type RowAttachment,
+  SEPARATOR,
+  type Table,
+} from "@budibase/types"
+import fs from "fs"
+import fsp from "fs/promises"
+import { extname, join } from "path"
+import { Transform } from "stream"
+import { pipeline } from "stream/promises"
+import { ObjectStoreBuckets } from "../../../../constants"
+import LinkDocumentImpl from "../../../../db/linkedRows/LinkDocument"
+import { getLinkDocuments } from "../../../../db/linkedRows/linkUtils"
+import { generateRowID, getRowParams } from "../../../../db/utils"
+import {
+  MAX_PROJECT_EXTRACTED_SIZE_BYTES,
+  MAX_PROJECT_PACKAGE_ENTRIES,
+  PROJECT_ATTACHMENTS_DIRECTORY,
+} from "./constants"
+
+const ROW_PAGE_SIZE = 1000
+const invalidData = (message: string) =>
+  new HTTPError(`Project package data ${message}.`, 400)
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === "object" && value !== null && !Array.isArray(value)
+
+const internalTables = (tables: Table[]) =>
+  new Map(
+    tables
+      .filter(
+        table =>
+          table._id &&
+          table._id !== InternalTable.USER_METADATA &&
+          table.sourceId === INTERNAL_TABLE_SOURCE_ID
+      )
+      .map(table => [table._id!, table])
+  )
+
+const isSourceAttachmentKey = ({
+  key,
+  workspaceId,
+}: {
+  key: string
+  workspaceId: string
+}) =>
+  key.startsWith(`${db.getProdWorkspaceID(workspaceId)}/attachments/`) &&
+  !key.includes("\\") &&
+  key.split("/").every(part => part && part !== "." && part !== "..")
+
+const mapRowAttachments = ({
+  row,
+  table,
+  map,
+}: {
+  row: Row
+  table: Table
+  map: (attachment: RowAttachment) => RowAttachment
+}) => {
+  const mapAttachment = (value: unknown): RowAttachment => {
+    if (
+      !isRecord(value) ||
+      typeof value.key !== "string" ||
+      !value.key ||
+      typeof value.name !== "string" ||
+      typeof value.extension !== "string" ||
+      typeof value.size !== "number" ||
+      !Number.isFinite(value.size) ||
+      value.size < 0
+    ) {
+      throw invalidData("contains an invalid attachment")
+    }
+    return map({
+      key: value.key,
+      name: value.name,
+      extension: value.extension,
+      size: value.size,
+    })
+  }
+
+  for (const [name, field] of Object.entries(table.schema)) {
+    const value: unknown = row[name]
+    if (value == null || value === "") {
+      continue
+    }
+    if (field.type === FieldType.ATTACHMENTS) {
+      if (!Array.isArray(value)) {
+        throw invalidData("contains an invalid attachment list")
+      }
+      row[name] = value.map(mapAttachment)
+    } else if (
+      field.type === FieldType.ATTACHMENT_SINGLE ||
+      field.type === FieldType.SIGNATURE_SINGLE
+    ) {
+      row[name] = mapAttachment(value)
+    }
+  }
+}
+
+const copyRow = (row: Row): Row => {
+  const copy = structuredClone(row)
+  delete copy._rev
+  delete copy._deleted
+  delete copy._attachments
+  delete copy._viewId
+  delete copy.fromWorkspace
+  return copy
+}
+
+const isLinkInfo = (value: unknown): value is LinkInfo =>
+  isRecord(value) &&
+  typeof value.tableId === "string" &&
+  typeof value.rowId === "string" &&
+  typeof value.fieldName === "string"
+
+const relationshipDocument = ({ doc1, doc2 }: ProjectPackageRelationship) =>
+  new LinkDocumentImpl(
+    doc1.tableId,
+    doc1.fieldName,
+    doc1.rowId,
+    doc2.tableId,
+    doc2.fieldName,
+    doc2.rowId
+  )
+
+export const exportProjectData = async ({
+  workspaceId,
+  tables,
+  dirPath,
+}: {
+  workspaceId: string
+  tables: Table[]
+  dirPath: string
+}): Promise<{
+  data: ProjectPackageData
+  unsupportedContent: ProjectPackageUnsupportedContent[]
+}> => {
+  const selectedTables = internalTables(tables)
+  const data: ProjectPackageData = {
+    rows: [],
+    relationships: [],
+    attachments: [],
+  }
+  const attachments = new Map<string, ProjectPackageAttachment>()
+  const rowIds = new Set<string>()
+  let bytes = 0
+  const accountBytes = (size: number) => {
+    bytes += size
+    if (bytes > MAX_PROJECT_EXTRACTED_SIZE_BYTES) {
+      throw invalidData("exceeds the package size limit")
+    }
+  }
+
+  for (const [tableId, table] of selectedTables) {
+    let startAfter: string | undefined
+    while (true) {
+      const result = await context.getWorkspaceDB().allDocs<Row>(
+        getRowParams(tableId, null, {
+          include_docs: true,
+          limit: ROW_PAGE_SIZE,
+          ...(startAfter ? { startkey: startAfter, skip: 1 } : {}),
+        })
+      )
+      for (const entry of result.rows) {
+        const row = copyRow(entry.doc!)
+        mapRowAttachments({
+          row,
+          table,
+          map: attachment => {
+            const key = attachment.key!
+            if (!isSourceAttachmentKey({ key, workspaceId })) {
+              throw invalidData(
+                "references an attachment outside its workspace"
+              )
+            }
+            if (!attachments.has(key)) {
+              if (attachments.size >= MAX_PROJECT_PACKAGE_ENTRIES) {
+                throw invalidData("contains too many attachments")
+              }
+              attachments.set(key, {
+                key,
+                path: `${PROJECT_ATTACHMENTS_DIRECTORY}/${utils.newid()}`,
+              })
+            }
+            return attachment
+          },
+        })
+        accountBytes(Buffer.byteLength(JSON.stringify(row)))
+        data.rows.push(row)
+        rowIds.add(row._id!)
+      }
+      if (result.rows.length < ROW_PAGE_SIZE) {
+        break
+      }
+      startAfter = result.rows[result.rows.length - 1].id
+    }
+  }
+
+  const seenLinks = new Set<string>()
+  let excludedRelationships = 0
+  for (const tableId of selectedTables.keys()) {
+    const links = await getLinkDocuments({ tableId, includeDocs: true })
+    for (const link of links) {
+      if (seenLinks.has(link._id!)) {
+        continue
+      }
+      seenLinks.add(link._id!)
+      if (
+        !selectedTables.has(link.doc1.tableId) ||
+        !selectedTables.has(link.doc2.tableId) ||
+        !rowIds.has(link.doc1.rowId) ||
+        !rowIds.has(link.doc2.rowId)
+      ) {
+        excludedRelationships++
+        continue
+      }
+      const relationship = { doc1: link.doc1, doc2: link.doc2 }
+      accountBytes(Buffer.byteLength(JSON.stringify(relationship)))
+      data.relationships.push(relationship)
+    }
+  }
+
+  if (attachments.size) {
+    await fsp.mkdir(join(dirPath, PROJECT_ATTACHMENTS_DIRECTORY))
+  }
+  for (const attachment of attachments.values()) {
+    const { stream, contentType } = await objectStore.getReadStream(
+      ObjectStoreBuckets.APPS,
+      attachment.key
+    )
+    attachment.contentType = contentType
+    await pipeline(
+      stream,
+      new Transform({
+        transform(chunk: Buffer, _encoding, callback) {
+          try {
+            accountBytes(chunk.length)
+            callback(null, chunk)
+          } catch (error) {
+            callback(error as Error)
+          }
+        },
+      }),
+      fs.createWriteStream(join(dirPath, attachment.path))
+    )
+    data.attachments.push(attachment)
+  }
+  return {
+    data,
+    unsupportedContent: excludedRelationships
+      ? [
+          {
+            type: "excluded_row_relationship",
+            count: excludedRelationships,
+            reason:
+              "Row relationships to data outside this Project were omitted.",
+          },
+        ]
+      : [],
+  }
+}
+
+export const validateProjectData = ({
+  data,
+  tables,
+  sourceWorkspaceId,
+  attachmentPaths,
+}: {
+  data: unknown
+  tables: Table[]
+  sourceWorkspaceId: string
+  attachmentPaths: string[]
+}): ProjectPackageData => {
+  if (
+    !isRecord(data) ||
+    !Array.isArray(data.rows) ||
+    !Array.isArray(data.relationships) ||
+    !Array.isArray(data.attachments)
+  ) {
+    throw invalidData("is invalid")
+  }
+  const selectedTables = internalTables(tables)
+  const rows: Row[] = []
+  const rowTableIds = new Map<string, string>()
+  const referencedKeys = new Set<string>()
+  for (const row of data.rows) {
+    if (
+      !isRecord(row) ||
+      typeof row._id !== "string" ||
+      typeof row.tableId !== "string" ||
+      !selectedTables.has(row.tableId) ||
+      !row._id.startsWith(
+        `${DocumentType.ROW}${SEPARATOR}${row.tableId}${SEPARATOR}`
+      ) ||
+      rowTableIds.has(row._id)
+    ) {
+      throw invalidData("contains an invalid or duplicate row")
+    }
+    rowTableIds.set(row._id, row.tableId)
+    const copied = copyRow(row)
+    mapRowAttachments({
+      row: copied,
+      table: selectedTables.get(row.tableId)!,
+      map: attachment => {
+        referencedKeys.add(attachment.key!)
+        return attachment
+      },
+    })
+    rows.push(copied)
+  }
+
+  const relationships: ProjectPackageRelationship[] = []
+  const linkIds = new Set<string>()
+  for (const relationship of data.relationships) {
+    if (
+      !isRecord(relationship) ||
+      !isLinkInfo(relationship.doc1) ||
+      !isLinkInfo(relationship.doc2)
+    ) {
+      throw invalidData("contains an invalid relationship")
+    }
+    const { doc1, doc2 } = relationship
+    for (const [endpoint, other] of [
+      [doc1, doc2],
+      [doc2, doc1],
+    ]) {
+      const field = selectedTables.get(endpoint.tableId)?.schema[
+        endpoint.fieldName
+      ]
+      if (
+        rowTableIds.get(endpoint.rowId) !== endpoint.tableId ||
+        field?.type !== FieldType.LINK ||
+        field.tableId !== other.tableId ||
+        field.fieldName !== other.fieldName
+      ) {
+        throw invalidData(
+          "contains a relationship outside its rows or table schema"
+        )
+      }
+    }
+    const linkId = [doc1, doc2]
+      .map(endpoint =>
+        JSON.stringify([endpoint.tableId, endpoint.fieldName, endpoint.rowId])
+      )
+      .sort()
+      .join()
+    if (linkIds.has(linkId)) {
+      throw invalidData("contains a duplicate relationship")
+    }
+    linkIds.add(linkId)
+    relationships.push({ doc1, doc2 })
+  }
+
+  const attachments: ProjectPackageAttachment[] = []
+  const indexedPaths = new Set<string>()
+  for (const attachment of data.attachments) {
+    if (
+      !isRecord(attachment) ||
+      typeof attachment.key !== "string" ||
+      !isSourceAttachmentKey({
+        key: attachment.key,
+        workspaceId: sourceWorkspaceId,
+      }) ||
+      typeof attachment.path !== "string" ||
+      !/^attachments\/[A-Za-z0-9_-]+$/.test(attachment.path) ||
+      (attachment.contentType !== undefined &&
+        typeof attachment.contentType !== "string") ||
+      !referencedKeys.delete(attachment.key) ||
+      indexedPaths.has(attachment.path)
+    ) {
+      throw invalidData("contains an invalid or unreferenced attachment")
+    }
+    indexedPaths.add(attachment.path)
+    attachments.push({
+      key: attachment.key,
+      path: attachment.path,
+      contentType: attachment.contentType,
+    })
+  }
+  if (
+    referencedKeys.size ||
+    indexedPaths.size !== attachmentPaths.length ||
+    attachmentPaths.some(path => !indexedPaths.has(path))
+  ) {
+    throw invalidData("attachments do not match the included files")
+  }
+  return { rows, relationships, attachments }
+}
+
+export const prepareProjectData = ({
+  data,
+  tables,
+  idMap,
+  workspaceId,
+  userId,
+}: {
+  data: ProjectPackageData
+  tables: Table[]
+  idMap: Map<string, string>
+  workspaceId: string
+  userId?: string
+}): {
+  rows: Row[]
+  relationships: LinkDocument[]
+  attachments: ProjectPackageAttachment[]
+  summary: ProjectDataImportSummary
+} => {
+  const selectedTables = internalTables(tables)
+  const importingUserId = userId && db.getGlobalIDFromUserMetadataID(userId)
+  for (const row of data.rows) {
+    const tableId = idMap.get(row.tableId!)
+    if (!tableId) {
+      throw invalidData("could not map an imported table")
+    }
+    const destinationRowId = generateRowID(tableId)
+    idMap.set(row._id!, destinationRowId)
+  }
+  const attachmentKeyMap = new Map<string, string>()
+  const attachments = data.attachments.map(attachment => {
+    const sourceExtension = extname(attachment.key)
+    const extension = /^\.[A-Za-z0-9]{1,16}$/.test(sourceExtension)
+      ? sourceExtension
+      : ""
+    const key = `${db.getProdWorkspaceID(workspaceId)}/attachments/${utils.newid()}${extension}`
+    attachmentKeyMap.set(attachment.key, key)
+    return { path: attachment.path, contentType: attachment.contentType, key }
+  })
+  const rows = data.rows.map(source => {
+    const table = selectedTables.get(source.tableId!)!
+    const row = copyRow(source)
+    row._id = idMap.get(source._id!)!
+    row.tableId = idMap.get(source.tableId!)!
+    mapRowAttachments({
+      row,
+      table,
+      map: attachment => ({
+        ...attachment,
+        key: attachmentKeyMap.get(attachment.key!)!,
+      }),
+    })
+    for (const [name, field] of Object.entries(table.schema)) {
+      const userReference =
+        ((field.type === FieldType.BB_REFERENCE ||
+          field.type === FieldType.BB_REFERENCE_SINGLE) &&
+          (field.subtype === BBReferenceFieldSubType.USER ||
+            field.subtype === BBReferenceFieldSubType.USERS)) ||
+        (field.autocolumn &&
+          (field.subtype === AutoFieldSubType.CREATED_BY ||
+            field.subtype === AutoFieldSubType.UPDATED_BY))
+      const value: unknown = row[name]
+      if (
+        !userReference ||
+        value == null ||
+        value === "" ||
+        (Array.isArray(value) && !value.length)
+      ) {
+        continue
+      }
+      if (!importingUserId) {
+        throw invalidData("requires an importing user for its user references")
+      }
+      row[name] =
+        field.type === FieldType.BB_REFERENCE_SINGLE
+          ? importingUserId
+          : [importingUserId]
+    }
+    return row
+  })
+  const remapEndpoint = (endpoint: LinkInfo): LinkInfo => ({
+    ...endpoint,
+    tableId: idMap.get(endpoint.tableId)!,
+    rowId: idMap.get(endpoint.rowId)!,
+  })
+  const relationships = data.relationships.map(({ doc1, doc2 }) =>
+    relationshipDocument({
+      doc1: remapEndpoint(doc1),
+      doc2: remapEndpoint(doc2),
+    })
+  )
+  return {
+    rows,
+    relationships,
+    attachments,
+    summary: {
+      tables: new Set(rows.map(row => row.tableId)).size,
+      rows: rows.length,
+      relationships: relationships.length,
+      attachments: attachments.length,
+    },
+  }
+}
diff --git a/packages/server/src/sdk/workspace/projects/backups/exports.ts b/packages/server/src/sdk/workspace/projects/backups/exports.ts
index 6bcd7488c2d..d06ab230762 100644
--- a/packages/server/src/sdk/workspace/projects/backups/exports.ts
+++ b/packages/server/src/sdk/workspace/projects/backups/exports.ts
@@ -4,6 +4,8 @@ import {
   AnyDocument,
   Automation,
   Datasource,
+  ExportProjectRequest,
+  Table,
   isEmailTrigger,
   KnowledgeBaseFile,
   Project,
@@ -30,6 +32,7 @@ import {
 } from "../../resources/utils"
 import {
   MAX_PROJECT_ARCHIVE_SIZE_BYTES,
+  PROJECT_DATA_FILE,
   PROJECT_ATTACHMENTS_DIRECTORY,
   PROJECT_DEPENDENCY_INDEX_FILE,
   PROJECT_DOCS_DIRECTORY,
@@ -37,6 +40,7 @@ import {
   PROJECT_FILE,
   PROJECT_MANIFEST_FILE,
 } from "./constants"
+import { exportProjectData } from "./data"
 import { readProjectPackageFiles } from "./files"
 import { doWithProjectAssignmentsLock } from "../lock"
 import {
@@ -351,9 +355,7 @@ async function encryptDirectory(dirPath: string, password: string) {
 
 export async function exportProject(
   projectId: string,
-  opts?: {
-    encryptPassword?: string
-  }
+  opts?: ExportProjectRequest
 ) {
   const workspaceId = context.getWorkspaceId()
   if (!workspaceId) {
@@ -483,6 +485,21 @@ export async function exportProject(
 
   const tmpPath = await fsp.mkdtemp(join(budibaseTempDir(), "project-export-"))
   try {
+    if (opts?.includeRows) {
+      const { data, unsupportedContent: omittedData } = await exportProjectData(
+        {
+          workspaceId,
+          tables: exportedDocs.filter(
+            doc => typeByResourceId.get(doc._id!) === ResourceType.TABLE
+          ) as Table[],
+          dirPath: tmpPath,
+        }
+      )
+      manifest.containsRows = data.rows.length > 0
+      manifest.containsAttachments = data.attachments.length > 0
+      manifest.unsupportedContent.push(...omittedData)
+      await writeJsonFile(join(tmpPath, PROJECT_DATA_FILE), data)
+    }
     await writeJsonFile(join(tmpPath, PROJECT_MANIFEST_FILE), manifest)
     await writeJsonFile(
       join(tmpPath, PROJECT_FILE),
@@ -539,12 +556,13 @@ export async function exportProject(
 export async function streamExportProject({
   projectId,
   encryptPassword,
-}: {
+  includeRows,
+}: ExportProjectRequest & {
   projectId: string
-  encryptPassword?: string
 }) {
   const tarPath = await exportProject(projectId, {
     encryptPassword,
+    includeRows,
   })
   const stream = streamFile(tarPath)
   const cleanup = () => {
diff --git a/packages/server/src/sdk/workspace/projects/backups/imports.ts b/packages/server/src/sdk/workspace/projects/backups/imports.ts
index 294cc41fb03..a2a538a8a79 100644
--- a/packages/server/src/sdk/workspace/projects/backups/imports.ts
+++ b/packages/server/src/sdk/workspace/projects/backups/imports.ts
@@ -4,8 +4,11 @@ import {
   docIds,
   encryption,
   HTTPError,
+  UsageLimitWarning,
+  objectStore,
   utils,
 } from "@budibase/backend-core"
+import { quotas } from "@budibase/pro"
 import { helpers } from "@budibase/shared-core"
 import { decodeJSBinding, encodeJSBinding } from "@budibase/string-templates"
 import {
@@ -23,6 +26,8 @@ import {
   ProjectImportRequirement,
   ProjectPackageDependencyIndex,
   ProjectPackageManifest,
+  ProjectPackageData,
+  IdentityType,
   Query,
   ResourceType,
   type RestAuthConfig,
@@ -65,6 +70,7 @@ import { getAppUrl } from "../../workspaces/utils"
 import { doWithProjectAssignmentsLock } from "../lock"
 import {
   PROJECT_ATTACHMENTS_DIRECTORY,
+  PROJECT_DATA_FILE,
   MAX_PROJECT_ARCHIVE_SIZE_BYTES,
   MAX_PROJECT_EXTRACTED_SIZE_BYTES,
   MAX_PROJECT_PACKAGE_ENTRIES,
@@ -74,13 +80,13 @@ import {
   PROJECT_FILE,
   PROJECT_MANIFEST_FILE,
 } from "./constants"
-import { getProjectIds, isProjectAssignableResourceType } from "../utils"
-
 import {
   readProjectPackageFiles,
   isSafeArchivePath,
   MAX_PROJECT_PATH_SEGMENTS,
 } from "./files"
+import { prepareProjectData, validateProjectData } from "./data"
+import { getProjectIds, isProjectAssignableResourceType } from "../utils"
 
 const IMPORT_ORDER: ResourceType[] = [
   ResourceType.AGENT,
@@ -140,6 +146,7 @@ interface ExtractedProjectPackage {
   project: Project
   dependencyIndex: ProjectPackageDependencyIndex
   docs: ImportedDoc[]
+  data?: ProjectPackageData
 }
 
 interface InsertedDocRef {
@@ -745,7 +752,9 @@ const validateManifest = (manifest: ProjectPackageManifest) => {
     !manifest.sourceWorkspace.id ||
     !dbCore.isDevWorkspaceID(manifest.sourceWorkspace.id) ||
     !isRecord(manifest.resourcesByType) ||
-    !Array.isArray(manifest.unsupportedContent)
+    !Array.isArray(manifest.unsupportedContent) ||
+    typeof manifest.containsRows !== "boolean" ||
+    typeof manifest.containsAttachments !== "boolean"
   ) {
     throw new HTTPError("Project package manifest is invalid.", 400)
   }
@@ -1229,6 +1238,8 @@ async function extractProjectPackage(
             PROJECT_FILE,
             PROJECT_DEPENDENCY_INDEX_FILE,
             PROJECT_DOCS_DIRECTORY,
+            PROJECT_DATA_FILE,
+            PROJECT_ATTACHMENTS_DIRECTORY,
           ].includes(entry)
       )
     ) {
@@ -1298,12 +1309,41 @@ async function extractProjectPackage(
 
     validateDependencyIndex(project, dependencyIndex, docs, manifest)
 
+    const attachmentPaths = packageFiles
+      .map(filePath => relative(tmpPath, filePath))
+      .filter(
+        filePath =>
+          filePath === PROJECT_ATTACHMENTS_DIRECTORY ||
+          filePath.startsWith(`${PROJECT_ATTACHMENTS_DIRECTORY}/`)
+      )
+    const data = rootEntries.includes(PROJECT_DATA_FILE)
+      ? validateProjectData({
+          data: await readJsonFile<unknown>(join(tmpPath, PROJECT_DATA_FILE)),
+          tables: docs
+            .filter(({ resourceType }) => resourceType === ResourceType.TABLE)
+            .map(({ doc }) => doc as Table),
+          sourceWorkspaceId: manifest.sourceWorkspace.id,
+          attachmentPaths,
+        })
+      : undefined
+    if (
+      manifest.containsRows !== !!data?.rows.length ||
+      manifest.containsAttachments !== !!data?.attachments.length ||
+      (!data && attachmentPaths.length)
+    ) {
+      throw new HTTPError(
+        "Project package data does not match its manifest.",
+        400
+      )
+    }
+
     return {
       tmpPath,
       manifest,
       project,
       dependencyIndex,
       docs,
+      data,
     }
   } catch (err) {
     await fsp.rm(tmpPath, { recursive: true, force: true })
@@ -1378,6 +1418,54 @@ const buildRequirements = ({
   })
 }
 
+const cleanupFailedProjectImport = async ({
+  insertedDocs,
+  importedProject,
+}: {
+  insertedDocs: InsertedDocRef[]
+  importedProject?: Project
+}) => {
+  try {
+    if (insertedDocs.length) {
+      await context.getWorkspaceDB().bulkRemove(insertedDocs, {
+        silenceErrors: true,
+      })
+    }
+    if (importedProject?._id && importedProject._rev) {
+      await context
+        .getWorkspaceDB()
+        .remove(importedProject._id, importedProject._rev)
+    }
+  } catch (err) {
+    console.log("Failed to clean up Project import", err)
+  }
+}
+
+const cleanupProjectAttachments = async (uploadedKeys: string[]) => {
+  const cleanupTasks: Promise<unknown>[] = []
+  for (let start = 0; start < uploadedKeys.length; start += 1000) {
+    cleanupTasks.push(
+      objectStore
+        .deleteFiles(
+          objectStore.ObjectStoreBuckets.APPS,
+          uploadedKeys.slice(start, start + 1000)
+        )
+        .then(result => {
+          if (result.Errors?.length) {
+            throw new Error(
+              `Failed to remove ${result.Errors.length} Project attachment(s).`
+            )
+          }
+        })
+    )
+  }
+  for (const result of await Promise.allSettled(cleanupTasks)) {
+    if (result.status === "rejected") {
+      console.log("Failed to clean up Project attachments", result.reason)
+    }
+  }
+}
+
 export async function importProject(
   file: { path: string },
   opts?: { encryptPassword?: string }
@@ -1388,24 +1476,50 @@ export async function importProject(
   }
 
   const extracted = await extractProjectPackage(file, opts?.encryptPassword)
+  const uploadedKeys: string[] = []
+  let persisted = false
   try {
+    const idMap = new Map<string, string>([
+      [extracted.manifest.sourceWorkspace.id, workspaceId],
+    ])
+    assignImportedIds({ docs: extracted.docs, idMap })
+    const identity = context.getIdentity()
+    const preparedData = extracted.data
+      ? prepareProjectData({
+          data: extracted.data,
+          tables: extracted.docs
+            .filter(({ resourceType }) => resourceType === ResourceType.TABLE)
+            .map(({ doc }) => doc as Table),
+          idMap,
+          workspaceId,
+          userId:
+            identity?.type === IdentityType.USER ? identity._id : undefined,
+        })
+      : undefined
+
+    if (preparedData) {
+      for (const attachment of preparedData.attachments) {
+        uploadedKeys.push(attachment.key)
+        await objectStore.streamUpload({
+          bucket: objectStore.ObjectStoreBuckets.APPS,
+          stream: fs.createReadStream(join(extracted.tmpPath, attachment.path)),
+          filename: attachment.key,
+          type: attachment.contentType,
+        })
+      }
+    }
+
     return await doWithProjectAssignmentsLock(async () => {
       const insertedDocs: InsertedDocRef[] = []
       let importedProject: Project | undefined
-      try {
+      const persistImport = async (): Promise<ImportProjectResponse> => {
         importedProject = await sdk.projects.create({
           name: extracted.project.name,
           description: extracted.project.description,
           color: extracted.project.color,
         })
         const importedProjectId = importedProject._id!
-
-        const idMap = new Map<string, string>([
-          [extracted.project._id!, importedProjectId],
-          [extracted.manifest.sourceWorkspace.id, workspaceId],
-        ])
-
-        assignImportedIds({ docs: extracted.docs, idMap })
+        idMap.set(extracted.project._id!, importedProjectId)
         const datasourcesById = new Map(
           extracted.docs
             .filter(doc => doc.resourceType === ResourceType.DATASOURCE)
@@ -1459,6 +1573,19 @@ export async function importProject(
           resources[resourceType] = docsToInsert.map(doc => doc._id!)
         }
 
+        if (preparedData) {
+          const dataDocs: AnyDocument[] = [
+            ...preparedData.rows,
+            ...preparedData.relationships,
+          ]
+          for (let start = 0; start < dataDocs.length; start += 250) {
+            await bulkInsertDocs(
+              dataDocs.slice(start, start + 250),
+              insertedDocs
+            )
+          }
+        }
+
         const requirements = buildRequirements({
           docs: extracted.docs,
           datasourcesById,
@@ -1482,22 +1609,30 @@ export async function importProject(
           resources,
           unsupportedContent: extracted.manifest.unsupportedContent,
           requirements,
+          ...(preparedData && { dataImport: preparedData.summary }),
         }
+      }
+
+      try {
+        const result = preparedData?.rows.length
+          ? await quotas.addRows(preparedData.rows.length, persistImport)
+          : await persistImport()
+        persisted = true
+        return result
       } catch (err) {
-        if (insertedDocs.length) {
-          await context.getWorkspaceDB().bulkRemove(insertedDocs, {
-            silenceErrors: true,
-          })
-        }
-        if (importedProject?._id && importedProject._rev) {
-          await context
-            .getWorkspaceDB()
-            .remove(importedProject._id, importedProject._rev)
-            .catch(() => {})
-        }
+        await cleanupFailedProjectImport({ insertedDocs, importedProject })
         throw err
       }
     })
+  } catch (err) {
+    // Releasing the lock can fail after the import has succeeded.
+    if (!persisted) {
+      await cleanupProjectAttachments(uploadedKeys)
+    }
+    if (err instanceof UsageLimitWarning) {
+      throw new HTTPError(err.message, 400)
+    }
+    throw err
   } finally {
     await fsp.rm(extracted.tmpPath, { recursive: true, force: true })
   }
diff --git a/packages/types/src/api/web/workspace/project.ts b/packages/types/src/api/web/workspace/project.ts
index 460858b2693..7f5cb5ff6a3 100644
--- a/packages/types/src/api/web/workspace/project.ts
+++ b/packages/types/src/api/web/workspace/project.ts
@@ -1,4 +1,5 @@
 import type { ReadStream } from "fs"
+import type { LinkInfo, Row } from "../../../documents"
 import { ResourceType, UsedResource } from "./resource"
 
 export interface ProjectResponse {
@@ -69,6 +70,7 @@ export interface UpdateProjectAssignmentResponse {
 
 export interface ExportProjectRequest {
   encryptPassword?: string
+  includeRows?: boolean
 }
 
 export type ExportProjectResponse = ReadStream
@@ -93,6 +95,31 @@ export interface ImportProjectResponse {
   resources: Partial<Record<ResourceType, string[]>>
   unsupportedContent: ProjectPackageUnsupportedContent[]
   requirements: ProjectImportRequirement[]
+  dataImport?: ProjectDataImportSummary
+}
+
+export interface ProjectDataImportSummary {
+  tables: number
+  rows: number
+  relationships: number
+  attachments: number
+}
+
+export interface ProjectPackageRelationship {
+  doc1: LinkInfo
+  doc2: LinkInfo
+}
+
+export interface ProjectPackageAttachment {
+  key: string
+  path: string
+  contentType?: string
+}
+
+export interface ProjectPackageData {
+  rows: Row[]
+  relationships: ProjectPackageRelationship[]
+  attachments: ProjectPackageAttachment[]
 }
 
 export interface ProjectManifestSummary {