The short answer
What can be produced, and by whom
- Per person
- A data-subject export from the People module
- Whole organisation
- A full export in open formats, with a manifest
- Delivery
- Generated asynchronously, downloaded over an expiring link
- Encrypted rooms
- Cannot be produced server-side, by anyone
- Erasure
- Refused by naming its rule when a hold applies
The request
Answer a data-subject access request in Enclessa
Work out which of the two exports you need
For an employee asking about their personnel data, the People module produces a data-subject export covering their record — identity, employment, and the rest of what the module holds about them.
Run the export and check the manifest
Exports are produced asynchronously and delivered over a signed link that expires, with a checksum.
Say plainly what the encrypted rooms contain and why they are not in it
Direct messages and group direct messages are end-to-end encrypted, so the server holds ciphertext and cannot produce their contents.
Check whether a hold blocks an erasure before you promise one
If the request is for deletion rather than access, retention categories and legal holds may require the record to be kept.
Keep the audit trail of what you did
Administrative action is recorded with the organisation it belongs to, and document downloads in the People module are audited individually — so the file showing how the request was handled is a by-product rather than something to assemble afterwards.
Without one platform
Four products, four answers
- The data is spread across products that do not agree
- Export means whatever the vendor decided it means
- Nobody knows what encryption means for the request
- Erasure and retention pull in opposite directions
Which plan this needs
The per-person data-subject export is part of the People module, on the Business plan. The organisation-wide export and the audit log are on every plan, Free included; retention rules and legal holds are on the Business plan and above.
Compare plansWhat it will not do
The limits, before you find them
- The per-person export covers the People module’s record of that person.
- End-to-end encrypted rooms cannot be produced server-side by anybody, including us.
- There is no compliance export in a supervision format such as CSV or Actiance XML, and no discovery tooling.
- Enclessa holds no data-protection certification and has commissioned no external audit.
- None of this is legal advice, and using Enclessa does not make an organisation compliant with anything.
FAQ
A data-subject access request: questions
- Yes, for their employment record. The People module produces a data-subject export generated asynchronously with a checksum and an expiring download link. Data outside that module is covered by the organisation-wide export.
- They cannot be produced by the server, because it holds ciphertext and no keys. The plaintext exists only on the participants’ own devices, so a copy has to come from there — which is the same property that makes the encryption worth having.
- Yes. A full organisation export produces what the platform holds in open formats, with a manifest naming every table and its row count, and it can include uploaded files. It is available whenever it is asked for.
Bring your team over this afternoon
Free for up to 10 people, with encrypted direct messages and video calls. No payment card, no time limit, no server to run.
For businesses and organisations only — not available to consumers.