Exporting or erasing a person's data

Download everything held about one person, or erase it after their access is revoked, while the audit trail stays in place.

For: Administrators (the admin ability) · Last updated

Use these two actions to answer a person's request for a copy of their data, or to remove it when they leave. Both are on the member table at Settings > Administration > Team > Members, and both need the admin ability. The auditor and executive abilities cannot export or erase another person's data.

Download a person's data#

  1. Select Download data on the person's row.
  2. Your browser downloads a ZIP archive named person-data- followed by the person's id.

The archive has one file per kind of data, plus manifest.json (every file with its row count) and README.txt. Each .jsonl file holds one JSON record per line. It includes:

  • the person's profile, abilities, Team memberships and rate band assignment;
  • their conversations with the messages in them;
  • memories about them, and the documents they own (details and a Markdown copy);
  • comments and shares they made, and files they uploaded;
  • details of their secrets, SSH keys and API keys, never the values, private keys or full keys;
  • the accounts they linked to connected apps (app, account name, scopes and expiry, never tokens), their personal connector policies, their connector approval history (connector, function, status and times, without the request details), and the Coworker connections they granted;
  • reviews and feedback they gave, and their activity and usage references;
  • the audit log entries they appear in, and the sources shown in their conversations.

Other people appear only as ids, never by name or email. Anonymous survey answers are left out of a download an administrator makes; a person sees their own in their own download. A person whose data has been erased has nothing left to download.

Each download is recorded in the audit log. People can also download their own data. See My data.

Erase a person's data#

Erasing removes a person's data from the product. It is permanent.

  1. Revoke the person's access first. See Managing people. Erase data is offered only on revoked rows; an attempt on anyone else is refused with "Revoke this person's access before erasing their data."
  2. Select Show revoked (n), then Erase data on the person's row.
  3. The dialog "Erase name's data?" explains what is removed and says it can't be undone.
  4. Type the person's email address (their name if they have no email) in the confirmation field. Erase data stays unavailable until it matches.
  5. Select Erase data. The page confirms "Data erased."

Erasing a person who was already erased changes nothing.

What is erased#

  • The person's conversations, including every message, tool call record and attachment in them, and the files they uploaded.
  • Their memories, their own secrets (including linked accounts), their SSH keys and any authorizations they gave to external tools.
  • Their personal connector policies, connector approval requests and connection attempts. Connections, connectors and Coworker connections they created stay, with their name removed as the author.
  • Their abilities, Team, cohort and Knowledge Base editor memberships, and rate band assignment.
  • The feedback and bug reports they filed, and their secret requests.
  • Documents they own that nobody else can open.
  • Their API keys, which are revoked and have their name and secret removed. The usage totals behind them remain.

What stays, without the person's name#

  • Documents others can open, comments, reviews, proposal feedback and workflow review decisions stay, credited to Former member.
  • Anonymous survey answers stay and still count.
  • Coworkers they supervised, Apps they built and Knowledge Bases they owned become unassigned.
  • Usage and cost records, and activity records, stay with an anonymous reference. Any message text they held and the link to the erased conversation are removed.
  • Workflow runs they started stay, with their inputs, outputs and files removed.
  • Approver sign-offs recorded by name change to Former member, unless another person in the company has the same name. In that case they are left as written, because they cannot be attributed.

What the audit log keeps#

The audit log is never rewritten. Its entries keep an anonymous reference in place of the person, shown as Former member, and the erasure is itself an entry with row counts only. The audit log also keeps the address that past sign-ins, audit log views and exports, and person data downloads and erasures came from. Names a person typed into other people's messages or comments are not searched for.

The person's own row remains as Former member with a placeholder email address, so records that point at it still read correctly. The person no longer appears in the member list, cannot sign in, and their email address can be invited again.

Backups of the host volume are outside the product, and keep erased data until they expire.

Delete and erase#

Delete on a revoked row also erases the person's data first, in the same way, and then removes them from the Team. See Managing people.