Privacy controls
Three settings limit how long SZ-MCP keeps stored data that names clients, and
whether clients are named in it at all. They are in the Privacy card on
Configure › Data collection (/settings/data), which appears once a
controller login is saved. Every member can see them; only an organisation
admin (or the owner) can change them. Others see “Only an admin can change
these.”
What are the three settings and their defaults?
Section titled “What are the three settings and their defaults?”| Setting | Default | Range | What it governs |
|---|---|---|---|
| Events, alarms and client sessions | 14 days | 1 to 14 days | How long the stored log keeps events, alarms, client sessions, connection attempts and controller statistics |
| Application flows (AVC) | 2 days | Not stored, 1 or 2 days | ”Which client used which application, per AP every 5 minutes.” Not stored drops them on arrival |
| Pseudonymise clients in the log | Off | On or off | ”MACs, host names and user names become anon-… pseudonyms; a client can still be looked up by its MAC.” |
The card’s subtitle shows who changed the settings and when, or defaults if nobody has.
What happens when I shorten retention?
Section titled “What happens when I shorten retention?”Older rows are deleted as soon as you save. Lowering either retention setting first asks “Delete older data now?” (“Stored rows older than the new limits are deleted when you save.”) and saves with Save and delete. Deleted rows can’t be recovered. Raising a setting keeps rows longer from then on, but can’t bring back rows already deleted.
What does pseudonymising do?
Section titled “What does pseudonymising do?”It replaces client MACs, host names and user names in the stored log with
anon- followed by 12 hex characters, including rows stored before you
switched it on. Switching it on first asks “Pseudonymise clients?”:
Client MACs, host names and user names in the stored event and session log are replaced by pseudonyms, including what is already stored. This can’t be undone for those rows.
Looking a client up by its MAC still works; searching by host name in past events won’t. Clients connected now keep their names until 24 hours after they leave.
- The same client always gets the same pseudonym. Pseudonyms are a keyed hash under a key for your organisation, so a client’s journey still lines up, and someone who already knows a MAC can find its rows. Nobody can list who was there, and a pseudonym can’t be worked back to a MAC without the key.
- Identifiers repeated in text are replaced too. A MAC or name taken from a named field is replaced wherever it appears in the row, such as inside event text or session ids.
- Existing rows are rewritten in batches. The first 5,000 are rewritten when you save, and the rest during the hourly sweep. Until it finishes, the card shows how many older rows are still to rewrite (“this finishes within a few hours”).
- Current-state client rows go sooner. While pseudonymising is on, a client’s current-state row is removed 24 hours after it was last seen, rather than after 7 days.
What do the privacy settings not cover?
Section titled “What do the privacy settings not cover?”Only the stored log and current-state client rows. As the card says, “Metrics, alerts and the admin audit log are not affected.” In particular:
| Data | Kept |
|---|---|
| Metrics | By their own tiers, not by these settings |
| Alert history | By the alert engine’s own retention |
| The controller’s admin audit log | 400 days, regardless of these settings |
| Inventory, including client entries | Until they change or are removed, not pseudonymised |
| Write history | Not affected |
Claude sees the current settings, read-only, in stream.status(). While
pseudonymising is on, it also gets a note on how to look a client up by its
MAC.