Data protection and GDPR in SquadBear
Ask AI
Where personal data lives, what export and erasure do, and what a connected agent can see
What "export my data" returns, what "erase this person" removes, and what stays after erasure.
Self-service export
Anyone can request their own copy: My settings → Data & privacy → Request export in the account menu. An admin requests one on someone's behalf from that person's Data & privacy profile tab. Both paths are async: the job runs in the background, the Inbox is notified, and the download is session-gated.
The export is a single JSON file, one section per table: profile, balances, the balance
ledger, requests, time entries, attendance, schedules, teams, process runs, policy
acknowledgments, identities, notifications, sessions and the audit trail. A provenance
block lists, per table, the columns disclosed and the tables withheld. Uploaded
documents contribute metadata only (name, category, size, dates). Anonymous and alias
health-check answers are withheld.
Erasure
Erasure is admin-only and requires an offboarded subject; an active employee is refused.
An admin can't erase themself, and only an owner can erase an owner. Run it from the
person's profile, Data & privacy tab → Erase personal data, or erase_employee
over MCP.
It clears or placeholders: name, email, title, country, location, manager link, date of birth, service start date, custom fields, emergency contacts, and free text - leave reasons, time-entry notes, health check-in answers. It deletes their uploaded files and linked identities. If this was their last SquadBear workspace, the shared login account is tombstoned and its sessions, sign-in providers, passkeys and 2FA enrolment are deleted. An acknowledgment signature keeps its row - proof a policy was signed - but its typed name and IP/device info are cleared.
What stays: the balance ledger under the placeholder name, and the audit trail. Metadata on rows where the subject is the entity is blanked; rows that merely list them as actor keep theirs. Tasks and projects they touched keep their reference, resolving to the pseudonymized profile.
Anonymous health checks
Closing a run in Anonymous or Alias mode destroys the link between a person and their answers - the session key is dropped and every author hash rotated - so export and erasure have nothing to reach. A named run's answers reach their author's export, and erasure blanks the free text on those rows. See Team health checks.
What a connected agent can see
An agent connected over MCP acts as the person who connected it, under that person's role and the same domain checks the web app and REST API use. A manager's agent sees their reports' data; an employee's agent sees only their own. Which scopes a connection may use is fixed at consent time (see Connect Claude to SquadBear); that vocabulary is separate from workspace API-key scopes.
Worked example
A contractor who left Northlake six months ago - offboarded, status Disabled - emails asking SquadBear to delete their data. Marta finds them under People → People, opens the profile, and on the Data & privacy tab clicks Erase personal data. Afterward their name reads as a placeholder everywhere it appeared, their uploaded files are gone, and their old leave and time-entry text is cleared - while last year's reports still total the days they logged and the audit trail still records that a leave request was approved that month.