Skip to main content
The Settings tab (/enterprise/orgs/{org_id}/settings) collects org-wide governance controls that apply across every member and team.

​
Data retention policy

Set a retention period in days (blank = retain indefinitely), or place the org under legal hold to override retention entirely and block deletion.

​
Session sharing

Two independent toggles control who can see whose sessions:
  • Share across organization — any member can view and search any other member’s sessions.
  • Share within teams — members can view and search sessions from others on their own team(s) (has no effect while org-wide sharing is on).
Sharing is always read-only — a member can never edit, delete, or share a session they don’t own via this setting.

​
Session encryption

  • Org-wide encryption — new sessions are marked for background encryption going forward (existing sessions keep their current state until a backfill runs).
  • Admin decrypt access — an Allow/Block toggle controlling whether org admins and team leads can open encrypted session details for other members. Owners and system jobs can always access their own data.

​
Project name mappings

Rename or merge project names org-wide. These org-level names take precedence over each member’s own personal project mappings, everywhere a project name is shown in the dashboard.

​
SSO (SAML/OIDC)

A sub-page under Settings for configuring single sign-on: choose OIDC or SAML, paste provider config as JSON, and enable SSO for the org. See Roles & Access → SSO for what’s available now versus coming soon.

​
Signals & alert policy

  • Session idle gap threshold — sets the inactivity gap (default: 20 minutes) used by pattern P4 before a wait event is counted.
  • Enforce supported compression — switches installed hooks from observe-only to compression enforcement on their next session start.
  • Email alerts & cadence — configures org routing (security inbox, recipient inboxes, organization timezone), delivery cadences (immediate P0, daily/weekly digests at 08:00 recipient-local time), minimum severity, included detectors and signals, and project exclusions. Personal preferences live under My alerts on the Signals tab. See Signals Dashboard → Email alerts & notification cadence.

​
Coverage & device policy

Hook integrity and DLP posture are managed primarily from the Coverage tab. From Settings (or Coverage settings) admins can:
  • Require DLP — overrides local --no-dlp unless an unexpired exception applies
  • Require heartbeat — installs the rclm-heartbeat OS timer on developer machines
  • Configure gateway hosts / required providers used by AD-013 routing checks
  • (Enterprise) enable provider usage reconciliation for AD-013c
See Coverage Alerts for enrollment, privacy, and detector overview.

​
Compliance retention

Compliance metadata retention (snapshots, campaigns, exceptions) is managed under Compliance → Settings. Lowering the floor requires confirmation, shows a banner on Control health, and makes RC-AI-10 warn. See Compliance dashboard.

​
Who sees it

Admin only, including the SSO sub-page.