Data protection and GDPR in SquadBear
Where personal data lives, what export and erasure actually do, and what a connected agent can see
This is what to check before answering a works-council or data-subject question — what "export my data" returns, what "erase this person" removes, and what's kept and why.
Why this needs a precise answer
"Delete everything about me" and "delete everything the law lets you delete" aren't the same request, and a company still needs its financial and audit history after someone leaves. Export and erasure are both built to be exact about that difference, not just to look thorough.
Self-service export
Anyone can request their own copy: account menu → My settings → the "My data" section → Request data export. An admin can request it on someone's behalf from their profile's Data rights tab. Either way it's async — request it, it prepares in the background, your inbox is notified when it's ready, then it's a session-gated download.
The export is a single JSON file: profile, balances, the balance ledger, requests, time entries, schedules, teams, linked identities, notifications, audit trail and sessions. Uploaded documents are not bundled in — only their metadata (name, category, size, dates). Anonymous or alias health-check answers never appear in anyone's export — see below.
Erasure
Erasure is admin-only, and an admin can't erase themself. Run it from the person's
profile, Data rights tab → Erase personal data (or erase_employee via
API/MCP).
It clears or placeholders: name, email, title, country, manager link, custom fields, emergency contacts, and sensitive free text — leave reasons, time-entry notes, health check-in answers. It deletes their uploaded files and their login account, sessions and linked identities, unless they're still employed in another SquadBear workspace. An acknowledgment signature keeps its row — proof a policy was signed — but its typed name and IP/device info are cleared.
It deliberately keeps the balance ledger (financial history, now under a placeholder name) and the audit trail (the fact something happened; a description naming this person is blanked, but a record of someone else's history that merely lists them as actor is untouched). Tasks and projects they touched keep their reference, resolving to the now-anonymized profile rather than a hole.
Health checks are already anonymous
A closed run set to Anonymous or Alias mode doesn't wait for erasure — the link between a person and their answers is destroyed the moment the run closes, not just hidden. See Why run a team health check. Export and erasure both have nothing to remove there.
What a connected agent can see
An agent connected over MCP acts as the person who connected it, with that person's role and nothing more — the same checks the web app and REST API use, not a looser "agent mode." A manager's agent sees their reports' data; an employee's agent sees only their own. Which scopes a connection may use is fixed at consent time (see Connect Claude to SquadBear), separate from the scope list workspace API keys use.
Worked example
A contractor who left Northlake six months ago (already offboarded, status Inactive) emails asking SquadBear to delete their data. Marta finds them at People → Manage people, opens their profile, and on the Data rights tab clicks Erase personal data. Afterward: their name reads as a placeholder everywhere it appeared, their uploaded files are gone, and their old leave and time-entry text is cleared — but the days they logged still total correctly in last year's reports, and the audit trail still shows a leave request was approved that month, minus the wording that named them.