---
title: Data protection and GDPR in SquadBear
description: Where personal data lives, what export and erasure do, and what a connected agent can see
order: 3
---

What "export my data" returns, what "erase this person" removes, and what stays after
erasure.

## Self-service export

Anyone can request their own copy: **My settings → Data & privacy → Request export** in
the account menu. An admin requests one on someone's behalf from that person's
**Data & privacy** profile tab. Both paths are async: the job runs in the background,
the Inbox is notified, and the download is session-gated.

The export is a single JSON file, one section per table: profile, balances, the balance
ledger, requests, time entries, attendance, schedules, teams, process runs, policy
acknowledgments, identities, notifications, sessions and the audit trail. A `provenance`
block lists, per table, the columns disclosed and the tables withheld. Uploaded
documents contribute metadata only (name, category, size, dates). Anonymous and alias
health-check answers are withheld.

## Erasure

Erasure is admin-only and requires an offboarded subject; an active employee is refused.
An admin can't erase themself, and only an owner can erase an owner. Run it from the
person's profile, **Data & privacy** tab → **Erase personal data**, or `erase_employee`
over MCP.

It clears or placeholders: name, email, title, country, location, manager link, date of
birth, service start date, custom fields, emergency contacts, and free text - leave
reasons, time-entry notes, health check-in answers. It deletes their uploaded files and
linked identities. If this was their last SquadBear workspace, the shared login account
is tombstoned and its sessions, sign-in providers, passkeys and 2FA enrolment are
deleted. An acknowledgment signature keeps its row - proof a policy was signed - but its
typed name and IP/device info are cleared.

What stays: the balance ledger under the placeholder name, and the audit trail. Metadata
on rows where the subject is the entity is blanked; rows that merely list them as actor
keep theirs. Tasks and projects they touched keep their reference, resolving to the
pseudonymized profile.

> [!WARN]
> Erasure is irreversible. The cleared fields are gone; confirm the subject is the right person before running it.

## Anonymous health checks

Closing a run in Anonymous or Alias mode destroys the link between a person and their
answers - the session key is dropped and every author hash rotated - so export and
erasure have nothing to reach. A named run's answers reach their author's export, and
erasure blanks the free text on those rows. See
[Team health checks](/docs/health/why/).

## What a connected agent can see

An agent connected over MCP acts as the person who connected it, under that person's
role and the same domain checks the web app and REST API use. A manager's agent sees
their reports' data; an employee's agent sees only their own. Which scopes a connection
may use is fixed at consent time (see
[Connect Claude to SquadBear](/docs/getting-started/connect-an-agent/)); that vocabulary
is separate from workspace API-key scopes.

## Worked example

A contractor who left Northlake six months ago - offboarded, status Disabled - emails
asking SquadBear to delete their data. Marta finds them under **People → People**, opens
the profile, and on the **Data & privacy** tab clicks **Erase personal data**.
Afterward their name reads as a placeholder everywhere it appeared, their uploaded files
are gone, and their old leave and time-entry text is cleared - while last year's reports
still total the days they logged and the audit trail still records that a leave request
was approved that month.

> [!AGENT]
> Confirm this former employee is offboarded, then explain exactly what erasing them removes from SquadBear and what stays.

## Related

- [The people model in SquadBear](/docs/admin/people/)
- [Team health checks](/docs/health/why/)
- [Connect Claude to SquadBear](/docs/getting-started/connect-an-agent/)