Retention and privacy

Enterprise feature (new in 1.19.1, helpdesk). See the Helpdesk overview.

Desk settings → Retention and privacy decides how long helpdesk tickets are kept, and what happens to a person’s tickets when their account goes. It needs the desk capability Helpdesk settings (Admins, out of the box).

Nothing here happens until an admin turns it on. Closing solved tickets and anonymising or deleting old tickets each have their own switch, and both are off by default, including on an upgraded workspace: closed tickets are kept for good. While both are off, the nightly run does nothing. Only the account removal rule is on by default.

Closing solved tickets automatically

Turn on Close solved tickets automatically and set After N days without a reply (1 to 365; 7 is suggested). A solved ticket nobody has replied to for that long becomes Closed, with a line on its timeline.

A closed ticket doesn’t reopen. After it closes:

• an email reply opens a follow-up ticket instead (see What happens to a message);
• in Get help the request reads “This request is closed. Something else? Send a new request.”

Anonymising or deleting old tickets

Turn on Anonymise or delete old closed tickets, then set Keep closed tickets for a number of months (1 to 240) or years (1 to 20), then Anonymise or Delete. The period counts from when each ticket closed.

	Anonymise	Delete
The ticket	Stays, for reports	Moved to the recycle bin (1.19.4), then removed entirely 30 days later
Reports	Count it as before	Stop counting it
Can be undone	No	Within 30 days, by restoring it from the recycle bin

Anonymise keeps everything reports count (status, priority, team, request type, tags, channel, every date and reply target, and which agent wrote each message) and removes:

• the subject;
• the requester’s and the CCs’ names and email addresses, which become Former requester;
• the text of every message;
• the form answers and the survey comment;
• workflow notes, hand-offs and reply drafts;
• notes on logged time;
• the ticket’s checklists (1.19.2), since item titles may name the requester;
• for a major incident’s own ticket (1.19.2), its updates, title, rule and the declarer’s name;
• (1.19.3) the assets linked to it, and the device from its asset entries in the audit log, since which device a person had is personal. Maintenance records already in Snipe-IT stay there;
• (1.19.4) where the request lived in Teams or Slack, and any chat card waiting for it;
• (1.20.0) every Claude in the desk chat that touched the ticket, whichever ticket it was opened on, and every suggestion card about it;
• every attachment, including the file itself on disk.

It also:

• renames everyone who wrote on the requester’s side, not only the current requester and CCs;
• keeps the timeline lines reports count (status changes, “took the ticket”, “assigned the ticket to”), with requester-side names replaced, so past Reopened counts and pick-up times stay the same;
• rewrites the ticket’s bell notices to “#1047 Anonymised request”;
• removes the subject, names and addresses from the ticket’s audit log entries, keeping the action, who did it, when, and the ids;
• removes a customer portal customer who is left with no ticket, with their sessions and links. A blocked customer keeps only their address, so the block still holds.

Anything added to an anonymised ticket later is anonymised again on the next run.

Delete removes the ticket, its conversation and its files for good. From 1.19.4 it does that through the recycle bin: each run moves the old closed tickets it selected to the bin, shown as Deleted by Retention rule, never their open workflow tasks, and the bin’s daily purge deletes them for good 30 days later. Until then they can be restored. Deleting a ticket for good also deletes every Claude in the desk chat that touched it (1.20.0). Tickets already in the bin aren’t closed or anonymised by retention.

Open tickets and tickets on legal hold are never touched, whatever the settings say.

When you save a change that will remove data, the page asks first: Move old tickets to the recycle bin? (before 1.19.4, Delete old tickets for good?) when you choose Delete, or Anonymise old tickets? when you turn anonymising on and tickets are already due. Each says how many tickets the next run would change.

Preview the next run

Preview the next run says what the next nightly run would do with the settings on the page, saved or not: how many tickets would close, be anonymised or go to the recycle bin, and how many are kept because they are on legal hold. A rule that is off counts nothing; with both off it says “Both rules are off, so nothing is closed, anonymised or deleted.” See the list shows every ticket, with its team, when it was solved or closed, and what will happen to it. The preview and the run choose tickets the same way, so the list is exactly what a run at that moment would do.

When it runs

Once a night, after 02:00 in the helpdesk’s time zone, in batches of 200. Only one app instance runs it at a time. It needs the helpdesk licence, like the helpdesk’s other background work.

Legal hold

A ticket on legal hold is never closed, anonymised or deleted, by the retention rules or by an account’s removal. It also can’t be deleted by hand (from 1.19.4 it can’t be moved to the recycle bin), or merged into a ticket that isn’t on hold too.

From 1.19.4 a hold can also be placed on a ticket that is already in the recycle bin, from its banner (Place legal hold, for people with Helpdesk settings). The bin’s daily purge then skips it, and it stays until the hold is lifted.

People with Helpdesk settings see a Legal hold card in the ticket’s side panel: turn on Keep this ticket. The card says who set it and when. Everyone else who works the ticket sees the card only while the hold is on, read-only.

When an account is removed

With When an account is removed on (the default), deleting someone in Settings → Users anonymises their helpdesk tickets in the same step as the removal:

• every ticket they raised, open ones included, is anonymised whole; the agents’ replies keep the agents’ names;
• on tickets where they were a CC, their CC entry and their own messages are anonymised;
• their own messages and files are erased wherever else they wrote on the requester’s side. Messages they wrote as an agent keep their name.
• (1.20.0) every Claude in the desk chat that touched one of those tickets is deleted, and, if they were an agent, so are their own chats. The usage figures, which hold no content, stay without their name.

Tickets on legal hold are left alone. On a held ticket the person’s CC entry is kept, as the name and address it had, but it isn’t mailed.

The anonymising and the removal happen together: if either fails, nothing changes and the account stays, so you can try again. This runs whatever the licence says.

A person’s data export

When someone asks for the data CompassDocs holds about them, an admin downloads it from Settings → Users: open the ⋯ menu on that person’s row (“More actions for Sam Lee”) and choose Download personal data. It needs the Delete a user permission (user.delete), the same as erasing an account.

The download is a JSON file with the person’s name, username and email and, while Include tickets in a person’s data export is on (the default), their helpdesk requests:

• the requests they raised, whether from their account or by email from their address, each with the answers they gave and the public conversation, and marked with how they relate to it and any ticket it was merged into;
• conversations a merge moved into another ticket, listed under the request they came from;
• requests they were copied on or wrote on, with only their own public messages;
• (1.19.2) the major incidents they said affect them, with each incident’s title and when they said Me too;
• (1.19.3) on each request they raised, the assets linked to it, tag and name only;
• (1.19.4) the Teams and Slack accounts linked to them, and which of their requests were raised or followed in a chat app;
• (1.19.4) requests in the recycle bin, since their data is still held.

From 1.19.4 the download also holds their desk background (their choice and their own uploaded picture), and from 1.20.0 their own Claude in the desk chats (claude_in_the_desk: their questions and Claude’s answers, by ticket number, with times), whatever Include tickets in a person’s data export says.

Internal notes and replies waiting for review are never included as such. Claude’s answers in an agent’s own chats are included as they were written, and may mention what internal notes said, since the agent could read them. Each download is in the audit log.

In the audit log

Action	Shown as
helpdesk.retention.updated	Changed helpdesk retention settings
helpdesk.ticket.auto_closed	Closed solved tickets automatically (one entry per run, with the count)
helpdesk.ticket.anonymised	Anonymised helpdesk tickets (per run; an account removal is marked account_removed)
helpdesk.ticket.deleted_by_retention	Moved old helpdesk tickets to the recycle bin (per run; before 1.19.4, Deleted old helpdesk tickets)
helpdesk.ticket.legal_hold_set / .legal_hold_cleared	Put a ticket on / Took a ticket off legal hold
user.personal_data_exported	Exported a person’s data