> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seloria.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit trail and personal data

> Export the organization's audit history, and handle a person's right of access and right to be forgotten

Seloria records who did what and when across every record. This page covers how to get that history out, and how to answer a data subject request about a person.

## Exporting the audit trail

**Reports → Activity** lists the organization's audit history and exports it to Excel or CSV. The export covers **every record type** — requests, RFx, purchase orders, receipts, invoices, budgets, suppliers, settings changes — and takes a **date range**.

Each row carries the action, the record it happened on, who did it and when. This is what you hand an auditor who asks how a particular purchase was decided.

Exporting is available to **Buyer**, **PM** and **Admin**. A single export returns at most **50,000 rows**; narrow the date range if you hit that ceiling.

## How long the audit trail is kept

Audit history is retained for **seven years**, in line with Qatari record-keeping law. A scheduled job runs on the first of every month and purges activity older than that cut-off across the whole organization.

<Note>
  In practice nothing is being purged yet — Seloria's records don't go back seven years. The policy is active and audited from day one, so the retention window applies automatically as the history ages.
</Note>

## Signing a user out of every device

**Settings → Users** lets an admin force a person out of all their sessions. Use it when a laptop goes missing or someone leaves — deactivating an account stops future sign-ins, but forcing a sign-out ends the sessions already open.

## Right of access — exporting a person's data

For a data subject access or portability request, **Settings → Users → Export data** produces a downloadable JSON file with everything Seloria holds about that person: their profile, the content they authored, and an index of the records they created.

It is **admin-only**, limited to your own organization, and **read-only** — running it changes nothing.

## Right to be forgotten — erasing a person

**Settings → Users → Erase personal data** removes the person's identifying information.

What it actually does matters, so be precise with whoever is asking:

* It **anonymizes rather than deletes**. Name, email and avatar are scrubbed from the user record and from the sign-in account, and the person is deactivated and marked as anonymized. Their name is also scrubbed from messages they sent.
* **Business records are kept, with the authorship depersonalized.** The purchase orders, approvals and receipts they were involved in continue to exist — you cannot erase a purchase because the buyer asked to be forgotten, and no auditor would accept it if you could.

<Warning>
  Erasure is **irreversible**. To guard against a mistake, the action requires you to type the person's email to confirm.
</Warning>

Both the export and the erasure are themselves written to the audit trail, so you can prove the request was honoured and when.

## Related

* [Security](/platform/security) — sign-in, two-factor and how data is protected.
* [Roles and permissions](/roles/overview) — who can reach what in the first place.