Security & compliance

Workspace owners and admins find these tools under Settings → Security and Settings → Audit log. Admins can read the audit log and export data; only the owner can change retention, legal hold, allowed domains and single sign-on.

Audit log

Settings → Audit log lists important changes in your workspace, newest first, with the time, who did it, what happened and the details. It records:

• invitations sent, cancelled and accepted, and people joining
• members deactivated or reactivated, and role changes
• the workspace being renamed or deleted
• boards being created, renamed, archived, restored or deleted
• changes to retention, legal hold, allowed domains and single sign-on
• data exports being requested and downloaded
• sign-ins through single sign-on
• messages deleted automatically by your retention setting (shown as Deckbell (automatic))

Use the filters at the top to narrow the list. Each one has a search box, and you can tick several actions or several people at once; clear a filter to see everything again. Choose Load older entries at the bottom to go further back.

Message retention

By default Deckbell keeps chat history forever. To delete old messages automatically, open Settings → Security, pick a period under Keep messages for (30 days, 90 days, 180 days, 1 year or 2 years) and choose Save.

Every night, messages older than that period are permanently deleted, along with any files uploaded with them. This covers channels and direct messages. Deleted messages can't be recovered, so Deckbell asks you to confirm before you set or shorten the period.

A thread stays until all of its replies are older than the period, so a recent reply never disappears because the thread started long ago.

Projects, issues and comments are not affected by message retention.

Legal hold

Turn on Legal hold to pause all retention deletion, for example during an investigation or a legal dispute. While it's on, nothing is deleted, whatever the retention period. When you turn it off, deletion resumes that night, so Deckbell asks you to confirm first.

Export your data

Owners and admins can download a copy of the workspace from Settings → Security → Export data.

1. Choose Export data. Deckbell prepares the export in the background.
2. You get an email when it's ready (usually a few minutes for most workspaces).
3. Come back to Settings → Security and choose Download.

The export is a ZIP of JSON files: the workspace, members, projects, issues with their comments, channels and direct messages with their messages, and links to uploaded files. Download links are only valid for a few minutes and only work for the person who requested them, and each export is deleted after 7 days. One export can be prepared at a time.

Exports are kept in private storage that's never publicly reachable; the only way to get one is the download button.

The file contains your workspace's private conversations, so store it somewhere safe.

Allowed email domains

Under Allowed email domains, add the domains people must have an email address at, for example acme.com. Type a domain and press Enter to add it, and choose Save. Leave the list empty to allow any address.

When the list is set:

• invitations to other domains are refused
• invitations sent earlier to other domains can no longer be used to join
• single sign-on only adds people at these domains

People who are already in the workspace aren't removed. The domain must match exactly: acme.com doesn't include eu.acme.com, so add both if you need them.

Single sign-on (SAML)

Single sign-on lets people sign in through your company's identity provider, such as Okta, Microsoft Entra ID, Google Workspace or OneLogin. You set it up in Settings → Security → Single sign-on.

1. Add Deckbell to your identity provider

Create a new SAML app in your identity provider and copy these values from the Single sign-on section (each has a copy button):

• Entity ID (Audience)
• ACS URL, sometimes called the Reply URL or Single sign-on URL
• or import the Metadata URL if your identity provider supports it

Set the app to send the person's email address as the NameID (email format) or as an email attribute, and their full name as a name attribute. Then assign the people or groups who should have access.

2. Paste your identity provider's details

From your identity provider's SAML app, copy the IdP entity ID (also called the Issuer), the IdP sign-in URL and the signing certificate, and paste them into Deckbell. Under Email domains, add your company's domains, for example acme.com, and choose Save SSO settings.

3. Verify your domains

To prove a domain is yours, Deckbell shows a TXT record for each one:

1. At your DNS provider (Cloudflare, Route 53, GoDaddy…), add a TXT record with the name shown (for example _deckbell-verification.acme.com) and the value shown (starting with deckbell-domain-verification=).
2. Back in Deckbell, choose Verify next to the domain. DNS changes can take a few minutes to show up; if it doesn't verify straight away, try again shortly.

Sign-ins only go to your identity provider for verified domains. A domain can only be verified by one workspace, and you can remove the TXT record later only if you don't need to verify it again (removing a domain from the list and adding it back asks for verification again).

4. Turn it on and test

Switch on Allow sign-in with SSO and choose Save SSO settings. Then, in a private browser window, open the Deckbell sign-in page, choose Sign in with SSO and enter your work email. You should land in Deckbell after signing in at your identity provider.

The first time someone from your domains signs in this way, Deckbell creates their account and adds them to the workspace as a Member. People who already have a Deckbell account must be in the workspace first (invite them as usual), and can then sign in with SSO.

Require SSO

Once SSO works and at least one domain is verified, you can switch on Require SSO. Members whose email is at one of your verified domains can then no longer sign in with a password, an emailed code, Google or a passkey; they're asked to use Sign in with SSO. Anyone at those domains who is already signed in another way is signed out and asked to sign in with SSO. People at other domains, such as guests or contractors, sign in as before.

Test SSO before requiring it. If your identity provider is set up wrongly, members at your domains are locked out until it's fixed or SSO is turned off.

Signing in with SSO

On the sign-in page, choose Sign in with SSO, enter your work email and choose Continue with SSO. Deckbell sends you to your company's sign-in page and brings you back signed in. If your email's domain doesn't use single sign-on, you'll be asked to sign in another way.