Skip to main content

Security and Data Management

Audience: Users, administrators, organizational security and data owners

How is access restricted?​

Company records are tenant-scoped. Platform role, group access, company role and organization-unit assignments are evaluated together. Company and group boundaries explains the context in which records open.

Members and Team Leads read many business records across the company; writes, individual performance and confidential OKRs have narrower rules. Unit membership alone does not reveal a confidential record. Record ownership/contribution, administrator or authorized unit/ancestor leadership, and related records are considered. The Role Guide explains the detailed scope.

Module entitlement, menu availability and authority over a record are separate. Hiding a menu does not write a new role policy; enabling a module does not grant every user write access to every record.

Account security​

  • Use your own account; do not share passwords, reset links or API keys.
  • Sign out before leaving a shared device. Use the Profile guide for personal language/password and role information.
  • Suspend or remove a departing person's relevant company membership. Only the Super Admin suspends the platform account; these actions have different scopes.
  • Keep push keys only in the sending system. The Push guide explains revocation and creating a replacement.

Record history​

KPI changes appear in the KPI's History tab. Entitlement-set, platform-setting, license and assessment records retain their own scopes. Consult the appropriate area in History and Audit Records rather than expecting a single shared login/operation log.

Secret platform settings are not returned as readable values; the interface shows that a saved value exists. Keep plaintext secrets out of screenshots and support records.

Retention and backups​

The Super Admin uses Platform Settings to manage retention for AI conversations and specified tool/usage, notification and integration records. Applicable nightly jobs clean up expired records. The periods for one record type do not apply to all others.

Operational backups, hosting region, access/deletion requests and legal retention obligations follow the deployment's agreement and operating procedures. Confirm those documents with your COS administrator and data owner; this guide does not promise fixed data residency, seven-year retention or certification.

AI and external connections​

Conversation messages and relevant tool-result content may be sent to the selected AI provider for processing. Check your organization's data-sharing rules and provider agreement before choosing company/group providers. AI Provider explains selection and scope.

An on-prem installation does not imply that every external connection is disabled. Configured email, Google sign-in, AI, web research or observability communicates with the corresponding service. Administrators should configure only organizationally approved destinations.

Suspected security event​

If unexpected record access or changes appear, note the time, company, record ID and reproduction steps; report them to your COS administrator through your organization's security process. Do not share secret values. The authorized team investigates access scope and relevant record history.