Manage retention and workforce privacy
Save explicit data-retention periods, verify a cleanup, and control the notice attestation required for workforce activity.
Before you start
- An online, MFA-verified administrator session.
- Your organization’s agreed retention requirements and a completed notice/review process before workforce collection.
- Owner participation when granting access to workforce analytics.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Retrieve current retention policies and statistics
Open Admin → Data Retention. Use Refresh retention policies and Refresh table statistics separately. Review Data, Rows, Estimated storage, and Retention (days). Row counts are exact observations; storage is estimated from database statistics. A missing or stale statistics result is not zero storage, and some observation tables can display unavailable statistics while retaining editable policies.
Enter retention for the required categories
Edit whole days in the relevant rows for telemetry, DEX events/history, endpoint history, alerts, workforce activity, app usage, issues, daily rollups, scripts, terminal/assistant sessions, endpoints, and observation data. A blank field means No saved policy; the suggested default is guidance and is not active retention. Most rows allow 1–3,650 days, workforce tables cap at 400 days, and the four observation-history tables require at least 90 days.
Save the policy and review it again
Choose Save changes (n) to save the edited rows, or Discard changes to abandon the draft. Read the confirmation, then Refresh retention policies to inspect the recorded days. The form stops further actions after an outcome until refreshed, so you review current values before another change. Policies older than five minutes must also be refreshed.
Run cleanup against saved settings
When no unsaved edits remain, choose Run cleanup now. This removes data that exceeds the saved retention policies. Read the confirmed deleted-row and removed-orphan-file counts, then refresh statistics. Cleanup is also scheduled nightly at 03:00 UTC. Saving a policy is separate from a completed cleanup, and tables without saved policies are not purged by this job.
What you should see: A confirmed cleanup result reports deletion counts; the refreshed table statistics provide the subsequent observed state.
Prepare workforce notice before enabling collection
Open Admin → Workforce privacy and choose Open employee notice template. Customize it for the actual collection, purpose, audience, access, and retention, complete the applicable review, and deliver it to affected workers. Workforce activity can include daily active/idle, first/last activity, after-hours/weekend totals, and coarse application categories. Complete your organization’s required legal, labor, works-council, and consultation review before attesting.
Record the current tenant attestation
In Record current notice, read the exact statement and confirm both checkboxes: that you customized and delivered the current notice before collection, and completed the applicable review. Choose Record tenant attestation. Verify Current notice is attested and its history entry. The attestation allows a requested activity policy to be issued; the module still needs to be enabled in Agent policies and remains subject to endpoint opt-out.
Grant reporting access separately and inspect collection
Have an owner use Members → Workforce analytics access to grant the separate capability to eligible admins/owners. Owners cannot grant themselves. Then inspect an endpoint’s capability, policy, and fresh activity evidence. Account role, notice attestation, enabled policy, platform capability, and local opt-out each affect whether a person can see data or a device can collect it.
Revoke outdated notice or erase a device’s records
If notice or review is no longer current, enter an optional Revocation reason and choose Revoke attestation, then confirm and check the updated status/history. This removes tenant authorization to issue activity collection; it does not delete historical data. Use retention and cleanup for routine expiry. For a specific endpoint’s full record erasure, use Agent fleet → Erase and read its irreversible deletion confirmation.
If something doesn’t work
Run cleanup now is disabled.
Save or discard draft edits first. After any completed or uncertain action, refresh policies before trying again; stale or unavailable policy reads also disable changes.
The retention action could not be confirmed.
It may already have changed data. Refresh both policies and statistics to reconcile the outcome before retrying.
Workforce collection remains off after attestation.
Verify the activity module is enabled for the device, the current attestation is unrevoked, the agent supports the capability, and local DEXIQ_DISABLE_ACTIVITY opt-out is not active.
An owner cannot open workforce analytics.
Owner membership is separate from the workforce capability. Another owner must grant access through Members; self-grants are not permitted.