One place for the rules roles inherit. A policy is written once here and bound to any number of roles, so changing a rule such as an export cap does not mean editing seven roles.

Policies

Standard Staff Policy
4 roles bound
Restricted Desk Policy
1 role bound
Document Handling Policy
1 role bound
External Party Policy
1 role bound
Data Retention Policy
Company-wide
Leave Policy 2026
Company-wide
 New policy

Standard Staff Policy

Version 4 · effective 01 Apr 2026 · bound to 4 roles
Active
RulesBound roles AcknowledgementsVersion history

Data handling

Export requires a reason
Free-text reason stored on the export log entry
Daily export cap
500 rows per user per day
Number reveal is logged
Every unmasking writes who, when and which record
Bulk delete allowed
Off — deletes go one record at a time

Session & access

Two-factor authentication
Required for every bound role
Idle session timeout
Signed out after inactivity
Restrict to office IP range
Off — field staff work from outside

Offboarding defaults

Force logout on deactivation
Pre-ticked on the offboarding action
Revoke vault access on deactivation
Including any live share links
Block deactivation while records are unassigned
Handover must be chosen first
Publishing asks 48 bound users to re-acknowledge