Data protection and GDPR in SquadBear
Ask AI
EU or US data region, what export and erasure do, and what a connected agent can see
What "export my data" returns, what "erase this person" removes, and what stays after erasure. Where the workspace lives (EU or US) is chosen at sign-up.
Data region
Registration step 1 asks for a data region: European Union or United States. That choice is stored with the workspace and cannot be changed later. Uploaded documents and export files stay in that region's file store. The workspace database is placed in the same region. You can see the region at Settings → General.
Workspaces created before the US region existed stay in the EU. Moving a workspace between regions is an export into a new workspace, not a toggle.
Storage is regional. A click may still be handled at the nearest Cloudflare location; background jobs may run globally and carry identifiers, not copies of the files.
The public summary, including tenant isolation and how optional AI features process data, is on Security, data residency and GDPR.
Self-service export
Anyone can request their own copy: Preferences → Your data → Request export in the account menu. An admin requests one on someone's behalf from that person's Record & privacy profile tab. Both paths are async: the job runs in the background, the Inbox is notified, and the download is session-gated.
The export is a single JSON file, one section per table: profile, balances, the balance
ledger, requests, time entries, attendance, schedules, teams, process runs, policy
acknowledgments, identities, notifications, sessions and the audit trail. A provenance
block lists, per table, the columns disclosed and the tables withheld. Uploaded
documents contribute metadata only (name, category, size, dates). Anonymous and alias
health-check answers are withheld.
Erasure
Erasure is admin-only and requires an offboarded subject; an active employee is refused.
An admin can't erase themself, and only an owner can erase an owner. Run it from the
person's profile, Record & privacy tab → Erase personal data, or erase_employee
over MCP. Over MCP the first call only prepares a 30-minute proposal; the assistant's
token cannot approve it. You commit from AI agents while signed in as the
same person. See Review assistant changes.
It clears or placeholders: name, email, title, country, location, manager link, date of birth, Leave seniority, contract type, the Leave details answers (children, previous employer, first job, could not take leave), expiry notices, custom fields, emergency contacts, and free text - leave reasons, time-entry notes, health check-in answers. It deletes their uploaded files and linked identities. If this was their last SquadBear workspace, the shared login account is tombstoned and its sessions, sign-in providers, passkeys and 2FA enrolment are deleted. An acknowledgment signature keeps its row - proof a policy was signed - but its typed name and IP/device info are cleared.
What stays: the balance ledger under the placeholder name, the employment start date and last day it is read against, and the audit trail. Metadata on rows where the subject is the entity is blanked; rows that merely list them as actor keep theirs. Tasks and projects they touched keep their reference, resolving to the pseudonymized profile.
Anonymous health checks
Closing a run in Anonymous or Alias mode destroys the link between a person and their answers - the session key is dropped and every author hash rotated - so a personal export or erasure request cannot identify those rows by account. Free text may still identify someone from its content. A named run's answers reach their author's export, and erasure blanks the free text on those rows. See Team health checks.
What a connected agent can see
An agent connected over MCP acts as the person who connected it, under that person's role and the same domain checks the web app and REST API use. A manager's agent sees their reports' data; an employee's agent sees only their own. Which scopes a connection may use is fixed at consent time (see Connect Claude to SquadBear); that vocabulary is separate from workspace API-key scopes.
An admin's or the person's own agent reads Leave seniority, date of birth and contract
type with get_employee_profile; an admin's agent also gets leaveIntake, the open
leave setup questions without values. Of these, the REST API carries only the contract
type.
Worked example
A contractor who left Northlake six months ago - offboarded, status Disabled - emails asking SquadBear to delete their data. Marta finds them under People → People, opens the profile, and on the Record & privacy tab clicks Erase personal data. Afterward their name reads as a placeholder everywhere it appeared, their uploaded files are gone, and their old leave and time-entry text is cleared - while last year's reports still total the days they logged and the audit trail still records that a leave request was approved that month.