Workspace settings › Data & retention now has Retention: one row each for public channels, private channels and direct messages, each kept forever or for a number of days you choose. Files can go before their messages — the message stays and says the retention rule removed its file — and canvases and lists can be deleted once nobody has edited them for a while. A rule that deletes sooner never starts straight away: it starts 30 days after you save it, members see the date in the header of every conversation it reaches, and you can cancel it under Upcoming changes until then. A rule under 30 days asks you to type “delete” first, and nothing is deleted while a legal hold stands — yours or one Kemble places. Changing what a conversation is never deletes sooner straight away either: a channel made private or public, or a group conversation made a private channel, keeps the rule it had for 30 days when its new kind’s rule is shorter, and its header says from when.
Turn on “Channel managers may set their channel’s own retention” and a channel’s managers can keep its messages for less time than the workspace’s rule — never longer. A channel’s details show its rule and who set it. Every run that deletes anything leaves one line in the audit log with how many messages, files, canvases and lists went, and your workspace’s data exports now include its retention rules.
Channel managers, and your workspace’s admins, can now choose how files work in a channel, under Files in its details’ Settings: turn off “Members can share files here”, so only managers post files; turn off “Members can download files here”, so members still see pictures and play clips in Kemble but get no download, no public link and no way to hand the file to an app; and, in a private channel, turn off “Guests may be added”. Everything is on until someone changes it, and Kemble holds these rules wherever a file comes in or goes out. And when a file is deleted — with its message, by a retention rule, or by Kemble’s staff — it now stops opening at once, even from a link someone opened a moment before.
Workspace owners can narrow a data export to one person’s messages or to chosen channels and direct messages, with dates. One person gives you only the messages they wrote, and chosen conversations gives you each one whole, in the same zip as a full export. Private channels and direct messages follow the same rule as a full export, and every narrowed export is in the audit log — whose messages or which conversations it covered are for your workspace’s owners alone; other admins see what kind of export it was. While a legal hold stands, an owner can also choose to include what the hold keeps; it’s off unless you tick it.
Approved networks: under Workspace settings › Security, owners list the addresses and ranges people may use the workspace from — IPv4 or IPv6, up to 100, each with a label — and turn it on. You’ll see your own address and whether it’s on the list, and Kemble won’t let you save a list that would lock you out. Anyone outside stays signed in and sees a calm page with their address to pass on; their other workspaces aren’t affected. Apps are held to the same networks unless an owner turns that off. While it’s on, notifications from the workspace say who and where, never the words, and a copy of your own data that holds the workspace downloads only from its networks.
Security alerts: workspace owners and admins can now see unusual activity in one place — someone taking far more files out than usual, a sign-in from a new country, lots of wrong sign-in codes, an app or webhook turning up on a new network, or a burst of deleted messages or channels. Each alert says who, what and when, links to the evidence and can be marked handled. Owners hear about new alerts in Activity, admins can turn that on, and owners choose when alerts are raised. Kemble keeps only what these need, for 90 days.
When we need to work on Kemble, everyone sees a calm maintenance screen instead of errors — and nobody is signed out, so Kemble is simply back when we’re done. Scheduled messages, call notes and poll results that fall due while Kemble is read-only now wait and go out afterwards, instead of failing. When one part of Kemble takes a short break, such as K Buddy or uploads, a strip at the top says so. And behind the scenes we now watch the share of errors against a 99.95% target, so trouble shows up sooner.
Announcements from Kemble show as a banner at the top of the app until you close it; some also come as a push to your devices, following your own notification settings, and, for the people who run an organization, by email. Report a problem, in Kemble Work’s Help menu and Kemble Circle’s account menu, sends a few words about what went wrong straight to our support team, and their reply comes by email.
Throwaway email addresses can be turned away at sign-up, and a quick check can appear when a sign-up looks risky. Organization owners may be asked to add two-step sign-in; you can put it off. New invitations to a workspace last a fortnight, unless Kemble shortens it to a week or a day, and invite links of an account Kemble has put on hold stop working until the hold is lifted. If a way of signing in is switched off halfway through, the sign-in page now says only what to do next.
Whenever Kemble steps in, your workspace says so. A reported message our trust and safety team takes down shows in your audit log as “Removed by Kemble”. A legal hold shows in your retention settings as “Held by Kemble”, and nothing can be deleted for good while it stands. If Kemble suspends an app, its owners and admins get a note in Activity, and if Kemble turns off K Buddy or GIF search for an organization, its settings say “Turned off by Kemble”.
Kemble can set a default for how long messages are kept on each plan; every plan keeps everything until then. If a default would delete anything in your workspace — or your workspace moves to a plan whose default would — your retention settings tell you the date first, and nothing is deleted for a month. A policy of your own always wins.