Your security rules. In one place
On the “Security & privacy” page, the owner decides what applies in your organisation: AI on or off, mandatory two-factor authentication, allowed networks and retention periods. The admin log shows who changed what and when.
- Plan: in every plan
- Changes: the owner
- Read access: admins
What you can do on the security and privacy page
AI master switch
“AI features” off means that no content from your organisation goes to the AI provider any more. The signals in the city keep running without AI.
Wellbeing and behaviour
Whether the AI may say anything at all about the wellbeing or behaviour of individual people is a separate switch. Default: off.
Meeting transcripts
Allowed or not, for the whole organisation. If they are allowed, each person decides for themselves before the call. Their switch is set to off beforehand.
Mandatory two-factor authentication
A code from an authenticator app, plus 8 backup codes. Before you switch it on, the page shows who does not have a second factor yet.
Allowed networks
Access only from your networks, up to 50 addresses or ranges. Owners stay exempt so that they cannot lock themselves out, but they then need a second factor.
Offline copy
Whether phones may keep an offline copy. It is deleted when someone logs out and after 14 days without syncing.
Retention periods
For channel and direct messages, inbox histories, resolved reports and meeting minutes. A daily run puts them into effect.
Admin log
Roles, switches, retention periods, automations, inboxes, permanent deletions and every access by our support team. Kept for one year.
| Area | Default | Can be set |
|---|---|---|
| Channel and direct messages | no limit | from 30 days |
| Inbox histories | no limit | from 180 days |
| Resolved reports | 365 days | from 30 days |
| Meeting minutes | 30 days | from 30 days |
Example organisation, no sign-up. Works on your phone too.
At a glance: plan, permissions, data
As implemented in KlangCity, as of October 2026.
- Plan: In every plan.
- Who can do what: The owner makes changes, admins can read along. Members and guests do not see the page. Mandatory two-factor authentication applies to all roles, guests included.
- Signals about people: The owner sets in five levels who sees signals about individual people, in the settings under members. Guests never see them.
- Fixed periods: Conversations with Klangi are not stored, task views are kept for 30 days, customer data from completed orders for 90 days and the admin log for one year.
- AI provider: Anthropic. Exactly what goes to the AI is set out in the AI section of the home page and in the review pack.
Works well with
- Automations: New connections and keys appear in the log.
- Shared inboxes: Retention period for inbox histories.
- Review pack: Contracts, roles concept and review logs.
Good to know
- Second factor only via an authenticator app, without SMS and without passkeys.
- There is no single sign-on yet. The target is Q1 2027.
- Allowed networks apply to logging in in the browser and in the app. For the API key (automations), you can switch them on as well if needed.
- Retention periods apply to messages, inboxes, reports and minutes. Tasks, projects, Drive and the handbook stay until you delete them.
- The log shows the 100 newest entries, and older ones can be loaded. There is no filter.
We would rather tell you up front what is missing. What comes next is on the roadmap.
Try it in the sample city
Everything in one tool, as a living 3D city. Walk through Nordlicht Studio without signing up, or start free with your team straight away. For the first 30 days you try Pro free, and after that Basic stays free for up to 5 people.
Example organisation, no sign-up. Works on your phone too.