Configure organisation policies

Organisation policies are the settings every user and every site inherits. They decide how long video is kept, what password your users must use, and which timezone the dashboard displays by default. Changing any of them applies immediately to new records; sites and users already in place are not retro-modified unless the policy change explicitly says so (retention is the exception — see below).

If you are on a fresh self-hosted install, the first-run Setup Wizard writes these same values. See Set up your first site for that walkthrough — do not use this how-to during initial install.

Caution

Lowering retention shortens the purge window for every site that inherits the default. Events and clips older than the new value are deleted by the next nightly cleanup job. Starred events are exempt. This is not reversible — export anything you want to keep before lowering retention.

Procedure

1. Open Settings from the left nav.
2. Under the Governance group, click Organisation Settings.

3. Set Default retention (days). Range: 7 - 365. New sites inherit this value; existing sites keep their per-site override. This is the fallback for any site without an explicit retention.
4. Set Default timezone. Choose an IANA timezone (for example America/New_York, Asia/Taipei). The dashboard and alert schedules use this when a site has none set.
5. Under Password policy, confirm the minimum length (v1 ships minimum 8, maximum 128). Additional complexity rules (uppercase / digit / special char) are deferred — see Password complexity status.
6. MFA requirement is not yet available in v1. The toggle is hidden until it ships — track the spec under SSO & MFA roadmap.
7. Click Save.

You see a toast confirming the update. The audit log records org.updated with the changes diff.

Common variations

• Per-site override for retention. If one site needs a longer window than the org default (for example a regulated site with 365-day retention), open that site’s detail page and set its retention_days directly. The per-site value wins over the org default. See Retention policy.
• Change the org display name. Same form, Name field. Slug is read-only after creation.
• Platform support access toggle (owner-only). The Allow platform admin impersonation checkbox is visible only to the Owner role and is not part of this how-to.

If this didn’t work

• If Save returns 403, you are not acting as admin or owner. Organisation policy is governance and is closed to operators and viewers by design (D81).
• If retention is rejected, the value is outside 7 - 365. Pick a value in range.
• If the timezone picker is empty, your browser failed to load the IANA list. Refresh the page.

Related

• Retention policy — how retention is applied per site and per starred event
• Governance vs operations — why admins own policy and operators own devices (D81)
• Set up your first site — the Setup Wizard that writes these values on initial install
• Roles and permissions — who can edit org settings