# Security, data and retention The two-person rule, the audit log, archiving, GDPR deletion, recovery, and how long Crew keeps each kind of data. Crew is built to hold people's data carefully: access is checked on every action, destructive steps can require two people, everything important is logged, and data is deleted on a schedule. Most of the settings on this page are under **Settings → Security & data** (Super Users). ## Built-in protections - **Access is checked by the server** on every action, against your current Discord roles (re-checked every few minutes). Hiding something in the app is never the only protection. - **Organizations are isolated.** Each organization's data is stored separately, and nothing in one organization can reach another. - **Recent sign-in for sensitive actions.** Deleting data, archiving, changing access or security settings, public sharing, API keys and webhooks require that you signed in with Discord within the last **15 minutes**. Otherwise Crew asks you to sign in again. - **Sensitive fields stay narrow.** Contact details, notes, disciplinary records, sensitive custom fields and leave reasons are only visible to the member, their managers and Super Users, and are never included in exports, the API, webhooks or the public directory. - **Moderation roles are never handed out.** Crew won't give or remove Discord roles that carry moderation or admin permissions. ## The two-person rule Turn on the **Two-person rule** and two actions need a **second Super User** to approve before they happen: - a **GDPR deletion** of a member, and - **archiving** the organization. The first Super User's request appears for the others under **Settings → Security & data**, and they're notified. Another Super User clicks **Approve** (it happens immediately) or **Reject**. The requester can **Withdraw** it. Requests that nobody approves expire after **2 days**. Turning the rule on or off notifies every other Super User, and turning it off cancels pending approvals. > [!TIP] > The two-person rule needs at least two Super Users. Give Super User access to a role with more than > one person in it before you turn it on. ## The audit log The **Audit log** (Super Users) records significant actions: who did what, to whom, and when. Members added and changed, role changes, records, requests and their decisions, jobs and applications, settings and access changes, integrations, and more. - Filter by category: **all**, **members**, **requests**, **records**, **jobs** or **system**. - Page through with **Newer** and **Older**. - **Export CSV** downloads time, actor, action, target and detail. Choose **Keep the audit log for** **7 days** (the default), **30**, **90**, **180 days** or **one year**. Shorter keeps less personal data; longer helps when you need to look back at what happened. ## Archiving and restoring **Archive organization** makes the organization **read-only**: everyone can still look, but nothing can be added or changed, `/crew` commands stop, and the API answers `403`. Use it when an organization pauses or winds down. Crew also archives an organization **automatically** when the Crew bot is removed from the server (checked daily), and tells the Super Users. - **Restore organization** brings it back. If the bot was removed, re-invite it first; Crew checks that it's back before restoring. - Organizations archived **because the bot was removed** are **permanently deleted after about 30 days**, unless a Super User restores them first. - Organizations you archive **yourself** are kept until you restore them. ## Deleting people's data (GDPR) To erase someone completely, a Super User opens their profile and clicks **Delete**. This **GDPR deletion**: - permanently removes the profile and everything attached to it in this organization: records, requests, leave, activity, checklists, custom field values and notifications; - removes their name from the organization's audit history and announcements; - takes away the Discord roles Crew manages for them; - can't be undone (recovery history ages out within 30 days, see below). If the person only left, consider setting their status to **Terminated** instead. See [Members and profiles](/crew/members#when-someone-leaves). People can delete their own Crew **account** under **Account settings**. That removes their sign-in, sessions and links to organizations, but not the records organizations keep about them. ## How long data is kept | Data | Kept for | | ------------------------------------- | -------------------------------------------------------- | | Profiles and records | Until deleted, or until the organization is deleted. | | Decided requests | 7 days after the decision. | | Approved leave | Until 90 days after the leave ended. | | Activity entries | 1 year by default; 90 days, 180 days, 1 year or 2 years. | | Audit log | 7 days by default; 30, 90, 180 days or 1 year. | | Notifications | 7 days. | | Webhook deliveries | 7 days. | | Job applications | 90 days after the decision. | | Sessions | 7 days without use, 30 days at most. | | Recovery history and older backups | 30 days. | | Organizations archived by bot removal | Deleted after about 30 days. | ## Recovery Our hosting provider keeps **30 days** of storage history, so data can be recovered after an incident. Data you delete disappears as that history ages out. It's only used to recover from incidents. ## Your organization's responsibilities Crew gives you the tools; your organization decides what to record. Only record what you need, keep access to the people who need it, and remember that API keys, webhooks and the public directory send data to systems you control. See the [Privacy Policy](https://crew.noyralabs.com/privacy) for how Nøyra Labs handles data, and email [legal@noyralabs.com](mailto:legal@noyralabs.com) with any data request. Source: https://docs.noyralabs.com/crew/security-and-data