Skip to main content
Privacy in Orgo works on two independent layers. You set organisation defaults that are copied onto each account the moment it is created, and every member then owns their own settings from that point on. On top of both, three tenant-wide settings decide who is allowed to browse the member directory at all. Default Privacy Settings with toggles for Name, Email, Phone, Age, Town, Profile Image, Profession and Social Media

​
Organisation defaults

Settings → Users & Profiles → Privacy Defaults. Requires ADMIN_TENANT. Toggle ON means the field is visible to the community by default.
These are a starting point, not a ceiling. The values are copied onto a member’s own privacy record once, when the account is created. Changing them afterwards does not touch a single existing member, and nothing stops a member from switching a field back on that you defaulted to admin-only. If a field must never be visible to other members, remove it from the profile form rather than relying on the default.

​
What a member controls

A member opens their own profile, then Settings & Privacy → Privacy. Local admins (ADMIN_LOCAL and above) and a parent managing a child’s profile see the same panel. Member privacy panel with the Make my profile completely private master switch above toggles for Name, Email, Phone, Age, Profile image and town, and Profession and social media The member panel groups fields more tightly than the admin defaults do: Profile image & town is one switch, and Profession & social media is another. Setting either one applies to both fields behind it. Each card shows its current state as “All community” or “Only by admins”. Make my profile completely private sits above the rest. Turning it on sets every field to private and greys the individual switches out. Turning it off sets every field back to visible.

​
What each setting actually hides

This is what a signed-in member without HR or Financial permissions sees on someone else’s profile. Three things are hidden from ordinary members no matter how the switches are set: date of birth, member card ID, and the identity verification record. Age can still be shown, date of birth cannot. Anonymous visitors and guest accounts get the strictest treatment. They see the shortened name and no email, phone, age, town, photo or profession, regardless of what the member chose.
Make my profile completely private does more than blank fields. The member is filtered out of member lists and directory queries entirely, and opening their profile URL returns “This profile is private” to anyone who is not allowed to see it.

​
Who sees the unredacted profile

Field-level privacy is skipped for:
  • the member themselves;
  • a parent who manages that member’s profile through the family feature;
  • ADMIN_TENANT;
  • anyone with HR_TENANT or FINANCIAL_TENANT, because both imply the assistant-level HR read;
  • anyone with HR_LOCAL, HR_PARENT_LOCAL, FINANCIAL_LOCAL or FINANCIAL_PARENT_LOCAL over that member’s local center, for the same reason.
The private-profile master switch is narrower: it is overridden only by ADMIN_TENANT, HR_TENANT, HR_LOCAL over the member’s local center, and ADMIN_PARENT_LOCAL inside its regional scope.
Financial permissions grant full profile visibility. If you appoint a treasurer at a local center, they can read every field on every member of that local center, privacy switches included.

​
Directory-wide visibility

Settings → Users & Profiles → Configuration, section Privacy & Visibility. All three require ADMIN_TENANT to change.

​
Bulk export

Exporting members to CSV requires HR_LOCAL at minimum, and the export is capped at 500 rows per page. A plain member cannot download the directory even for fields they are allowed to read on screen, so field visibility and bulk access are two separate controls.