Security, audit and legal holds

Three screens for the people responsible for security and compliance: Admin → Security, Admin → Audit log and Admin → Legal holds. Owners, admins and security admins can open all three.

Report content policy#

A report is HTML an AI wrote, and it runs in your readers' browsers. The content policy on Admin → Security decides what it may do there, for every report in the organisation. By default a report may run its own scripts but cannot reach anything on the internet. A change applies the next time a report is opened; nothing needs republishing.

Embedding#

Reports can be shown inside a page on another site — a SharePoint intranet, for example — only if that site is listed under Sites allowed to embed your reports. Enter one address per line, https:// and the host only, with no path. Everywhere else is refused. Readers who are not signed in see a link that opens the report in a new tab instead, because a browser will not let them sign in inside someone else's page.

Who may be given a report — guests, domains, public links — is on Admin → Sharing; see Sharing.

Classification of new reports#

Default classification — public, internal, confidential or restricted — is what a newly published report is classified as when the person or agent publishing it does not say. It starts at internal. Classification decides which publishing policies apply, so raising the default makes new work more guarded from its first version. Reports that already exist keep their classification.

The audit log#

Admin → Audit log is the record of what happened in the organisation: who published, shared, decided, invited, changed a setting or was refused, and when. Each event has a type (such as report.published), the person, agent or system that caused it, the thing it happened to, and the detail. Events cannot be edited or deleted from the app; they are removed only by the retention sweep described below.

• The screen shows the 200 most recent events. Filter by event type, by actor (an email address or agent name), and by date range.
• Download CSV exports the events matching the current filters, up to 5,000 rows, with the full detail of each.

How long events are kept

A daily sweep removes events older than your plan's audit history. The history of who viewed reports has its own, separate window.

Some events are never removed, whatever the plan: those beginning billing., platform., api_key. and legal_hold. — billing, platform operator activity, API keys and legal holds. And nothing is removed while a legal hold is in force.

Legal holds#

A legal hold stops deletion while a matter is open. Placing one is included in Enterprise; a hold already in force stays in force on every plan, including after a downgrade. Holds are placed and released on Admin → Legal holds by an owner, an admin or a security admin.

While any hold is in force:

• The retention sweep removes nothing from the organisation — neither audit events nor view history.
• The organisation cannot be closed. Any open hold refuses it, including a hold on a single report, because closing would delete that report too.
• A report's datasets cannot be deleted while a hold covers that report. The refusal names the hold's matter reference.

1. 1

   Give the matter a reference

   Whatever the instruction calls it, such as a case number. This is what appears on every refusal the hold causes.

2. 2

   Choose the scope

   The whole organisation, which is the usual choice at the start of a matter, or one named report.

3. 3

   Add a note if useful, and place the hold

   It appears under In force with who placed it and when.

To release a hold, choose Release and say why; the reason is required and kept. Released holds stay listed with their dates and who released them. Placing and releasing are recorded as legal_hold.placed and legal_hold.released, and those events outlive every retention window.