Crew is built to hold people's data carefully: access is checked on every action, destructive steps can require two people, everything important is logged, and data is deleted on a schedule. Most of the settings on this page are under Settings → Security & data (Super Users).
Built-in protections
- Access is checked by the server on every action, against your current Discord roles (re-checked every few minutes). Hiding something in the app is never the only protection.
- Organizations are isolated. Each organization's data is stored separately, and nothing in one organization can reach another.
- Recent sign-in for sensitive actions. Deleting data, archiving, changing access or security settings, public sharing, API keys and webhooks require that you signed in with Discord within the last 15 minutes. Otherwise Crew asks you to sign in again.
- Sensitive fields stay narrow. Contact details, notes, disciplinary records, sensitive custom fields and leave reasons are only visible to the member, their managers and Super Users, and are never included in exports, the API, webhooks or the public directory.
- Moderation roles are never handed out. Crew won't give or remove Discord roles that carry moderation or admin permissions.
The two-person rule
Turn on the Two-person rule and two actions need a second Super User to approve before they happen:
- a GDPR deletion of a member, and
- archiving the organization.
The first Super User's request appears for the others under Settings → Security & data, and they're notified. Another Super User clicks Approve (it happens immediately) or Reject. The requester can Withdraw it. Requests that nobody approves expire after 2 days.
Turning the rule on or off notifies every other Super User, and turning it off cancels pending approvals.
Tip: The two-person rule needs at least two Super Users. Give Super User access to a role with more than one person in it before you turn it on.
The audit log
The Audit log (Super Users) records significant actions: who did what, to whom, and when. Members added and changed, role changes, records, requests and their decisions, jobs and applications, settings and access changes, integrations, and more.
- Filter by category: all, members, requests, records, jobs or system.
- Page through with Newer and Older.
- Export CSV downloads time, actor, action, target and detail.
Choose Keep the audit log for 7 days (the default), 30, 90, 180 days or one year. Shorter keeps less personal data; longer helps when you need to look back at what happened.
Archiving and restoring
Archive organization makes the organization read-only: everyone can still look, but nothing
can be added or changed, /crew commands stop, and the API answers 403. Use it when an
organization pauses or winds down.
Crew also archives an organization automatically when the Crew bot is removed from the server (checked daily), and tells the Super Users.
- Restore organization brings it back. If the bot was removed, re-invite it first; Crew checks that it's back before restoring.
- Organizations archived because the bot was removed are permanently deleted after about 30 days, unless a Super User restores them first.
- Organizations you archive yourself are kept until you restore them.
Deleting people's data (GDPR)
To erase someone completely, a Super User opens their profile and clicks Delete. This GDPR deletion:
- permanently removes the profile and everything attached to it in this organization: records, requests, leave, activity, checklists, custom field values and notifications;
- removes their name from the organization's audit history and announcements;
- takes away the Discord roles Crew manages for them;
- can't be undone (recovery history ages out within 30 days, see below).
If the person only left, consider setting their status to Terminated instead. See Members and profiles.
People can delete their own Crew account under Account settings. That removes their sign-in, sessions and links to organizations, but not the records organizations keep about them.
How long data is kept
| Data | Kept for |
|---|---|
| Profiles and records | Until deleted, or until the organization is deleted. |
| Decided requests | 7 days after the decision. |
| Approved leave | Until 90 days after the leave ended. |
| Activity entries | 1 year by default; 90 days, 180 days, 1 year or 2 years. |
| Audit log | 7 days by default; 30, 90, 180 days or 1 year. |
| Notifications | 7 days. |
| Webhook deliveries | 7 days. |
| Job applications | 90 days after the decision. |
| Sessions | 7 days without use, 30 days at most. |
| Recovery history and older backups | 30 days. |
| Organizations archived by bot removal | Deleted after about 30 days. |
Recovery
Our hosting provider keeps 30 days of storage history, so data can be recovered after an incident. Data you delete disappears as that history ages out. It's only used to recover from incidents.
Your organization's responsibilities
Crew gives you the tools; your organization decides what to record. Only record what you need, keep access to the people who need it, and remember that API keys, webhooks and the public directory send data to systems you control. See the Privacy Policy for how Nøyra Labs handles data, and email legal@noyralabs.com with any data request.