> ## Documentation Index > Fetch the complete documentation index at: https://docs.chatnorris.ai/llms.txt > Use this file to discover all available pages before exploring further. # Organization security > How to require two-step verification, sign people out after inactivity, limit invitations, set how long conversations are kept and export your organization's data. # Organization security In **Settings → Security** you set access, invitation and data rules that apply to your whole organization. It's not the same as **Security** in an agent's settings, where you set that agent's domains and blocks. Owners and admins use this section; operators don't have access. Admins can change everything except **Who can invite**, which only the owner can change. When you change an option, the **Unsaved changes** bar appears. Click **Save** to apply it, or **Discard** to go back. Exporting data doesn't go through that bar: you request it with its own button. ## Require two-step verification By default, each member decides whether to turn on [two-step verification](https://docs.chatnorris.ai/en/cuenta-y-facturacion/gestionar-cuenta.md#two-step-verification) in **My account → Security**. With **Require two-step verification**, in the **Access** card, it becomes mandatory for all members, whatever their role. The row shows how many have it today (for example, *"3 of 5 members have it today"*). **1. Turn on your own verification first** To require it, you need to have it turned on yourself. If you don't, when you save you'll see *"First turn on your own two-step verification in My account › Security."* **2. Turn on the option and save** Turn on **Require two-step verification** and click **Save**. From then on, anyone who doesn't have it sees the **Set up two-step verification** screen the next time they sign in or open the panel, including if they sign in with Google or GitHub. Make sure your team has an authenticator app at hand: until they finish with **Set up now**, they can't keep using the panel. The other option on that screen is **Sign out**. While the requirement is on, anyone who turns off their verification in **My account → Security** will have to set it up again to keep using the panel. If you turn the option off, each member goes back to deciding for themselves. Those who already have it keep it. ## Sign out after inactivity **Sign out after inactivity**, in the **Access** card, asks people to sign in again after a while without using the panel. The options are **Never** (the default), **After 8 hours**, **After 24 hours** and **After 7 days**. * Clicking, typing, scrolling or touching the screen in any open panel tab in that browser counts as activity. * It applies to all members of the organization. * It doesn't interrupt ChatNorris Inbox on the phone while the person has push notifications on. ## Allowed domains In the **Invitations** card, **Allowed domains** limits who can be invited. Type a domain (for example, `company.com`) and click **Add**; to remove it, use the **×** on its tag. If the list is empty, any email can be invited. * The rule checks the exact domain: with `company.com`, an `@sales.company.com` email doesn't pass. Add each subdomain you need. * It also applies to resending an invitation that was already pending: if its email is no longer allowed, it can't be resent. * It doesn't affect members who are already in the organization. ## Who can invite **Who can invite**, also in **Invitations**, has two options: * **Owners and admins** (the default). * **Owner only**: admins can no longer invite or resend pending invitations. Operators can never invite. Only the owner can change this option, so an admin can't undo it. These two rules don't apply to invitations made by the ChatNorris team. ## Conversation retention In the **Data** card, **Keep conversations for** sets how long they're kept: **Always** (the default), **24 months**, **12 months** or **6 months**. The period counts from the last message of each conversation. Once the period is over, the conversation is deleted with its messages and attachments, and it **can't be recovered**. **What isn't deleted:** * Open conversations, however old they are. * Conversations linked to an external system. * Leads: they're kept even if the conversation they came from is deleted. Historical metrics that depend on the deleted conversations may go down. ### Seven days' notice When you turn on retention or shorten the period, ChatNorris shows you a dialog with how many conversations would be deleted today. Click **Turn on and save** to confirm. Then: 1. Owners and admins are notified by email. 2. Nothing is deleted for 7 days. The row shows the date of the first deletion. 3. From that date, deletion runs once a day. Until that date you can change the period or export your data. Going back to **Always** cancels the deletion. Lengthening the period doesn't need a new notice, because it doesn't delete anything the previous period wouldn't have deleted. ## Export your data In the **Data** card, **Export organization data** builds a ZIP file with leads, conversations, messages and agents in CSV. Click **Request export**: the file starts building right away and the button shows **Preparing…**. You can leave the page in the meantime. When it's ready, you can get it with **Download** in the same row or from the link we email you. If it fails, the row says so, we let you know by email and you can request it again right away. Export is included in the **Premium** plan. On other plans, the row shows *"Data export isn't included in your plan."* and the **Upgrade your plan** button, and you can't request or download it. | File | Contents | | - | - | | `agentes.csv` | Name, status, time zone and creation date of each agent | | `conversaciones.csv` | Agent, channel, status, visitor details and dates | | `mensajes.csv` | Conversation, author, text and date of each message | | `leads.csv` | Agent, conversation, name, email, phone and date | * **One every 24 hours:** the limit is per organization, not per person. An export that failed doesn't count toward this limit. * **Only the person who requested it can download it:** the **Download** button and the email are only for them. Other owners and admins see in the row who requested it and from when they can request another. * **24 hours to download it:** the button and the email link are valid for 24 hours from when the file is ready. After that you have to request another export. * **What it doesn't include:** attachments, the knowledge base or agent configuration. Each CSV goes up to 200,000 rows. > [!NOTE] > > The link gives access to the data without asking you to sign in. Don't forward it to people who shouldn't see it. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.