Protection levels & workflows
Protection levels form a fixed hierarchy. Every step reduces data exposure and may lock or remove additional data classes.
The four levels
Section titled “The four levels”| Level | Effect | Recoverable? |
|---|---|---|
| Original data | Complete source data is available. | Initial state |
| Pseudonymized | Identities are replaced by stable, explicit labels such as [Person 1]. Original media and mappings are protected. |
Yes, while recovery material exists |
| Identifying data removed | Identifying data is removed without a stable replacement identity. | Yes, while the protected original exists |
| Permanently anonymized | Original data, media, mappings, and recovery material are destroyed. | No |
The operation covers more than the visible transcript. StoryVault also governs titles and descriptions, speakers and participants, media and thumbnails, attachments, shares and exports, and derived data used by search, AI chat, knowledge stores, graphs, and qualitative coding. Corrected transcript content is processed as well, and users see the version allowed by the active level.
Tenant, project, and session
Section titled “Tenant, project, and session”Tenant policy is the minimum protection. A project may be stricter but never less strict than its tenant; a session may be stricter but never less strict than its project. A project operation includes its sessions, while a session operation affects only that session.
Protect a project or session
Section titled “Protect a project or session”- Open the project or session in the correct tenant.
- Open the Data protection and protection level shield menu.
- Select Pseudonymized, Identifying data removed, or Permanently anonymized.
- Select a purpose and enter the displayed confirmation phrase exactly.
- For a project, review the draft plan. It can still be changed or discarded.
- Start the plan with the visible play button.
- Complete DPA approval and monitor progress in data protection administration.
Operations that increase protection require the current user’s DPA capability, a purpose, exact confirmation, and an audit trail. They do not require a fresh login.
Understand the status
Section titled “Understand the status”| Status | Meaning |
|---|---|
| Draft | The plan is prepared and can still be changed or discarded. |
| Approval pending | A DPA must complete the purpose and confirmation. |
| Queued | The operation is waiting to be processed. |
| Running | Data is being processed and the affected area remains locked. |
| Completed | Every planned data object was processed successfully. |
| Partially completed / Failed | The safe state remains in place. A DPA reviews and resumes the existing run. |
| Manual review | A legal hold or policy change requires a decision. |
Use Check status in the shield menu to open the running operation. If a protected error view appears, a DPA can open the same operation from the recovery list. An error never makes original data visible.
Restore original data
Section titled “Restore original data”Pseudonymized or redacted data can be restored only if tenant policy permits original data, recovery material still exists, no legal hold or manual review blocks the operation, and the current user is a DPA in that tenant.
- Open the shield menu and select Original data.
- Provide the purpose and exact confirmation phrase.
- Complete the security confirmation and start the operation.
- Monitor progress in data protection administration.
The security confirmation is valid for ten minutes and is renewed only by a real password, Microsoft, or magic-link sign-in. Tenant switching and token refresh do not renew it.
Moving from pseudonymized or redacted data to permanent anonymization destroys the remaining recovery material. Moving from permanently anonymized data back to a less restrictive level is impossible.
Which transitions are possible?
Section titled “Which transitions are possible?”| From | To | Result |
|---|---|---|
| Original data | Pseudonymized / identifying data removed / permanently anonymized | Protection is increased. |
| Pseudonymized | Identifying data removed | The stable mapping is no longer used; the protected original may remain. |
| Pseudonymized or identifying data removed | Original data | Only through controlled recovery. |
| Pseudonymized or identifying data removed | Permanently anonymized | Recovery material and mappings are destroyed. |
| Permanently anonymized | Any less restrictive level | Not possible. |
Data protection in practice
Section titled “Data protection in practice”- Test a new policy with a dedicated test project first.
- Use Pseudonymized for recurring identities; use Identifying data removed when no stable replacement identity is needed.
- Review retention periods and legal holds before irreversible anonymization.
- Do not copy original names, transcripts, or storage links into support requests. Operation, project, and session IDs are sufficient for diagnosis.
During processing, the affected scope remains locked. A partial or failed operation never exposes originals. An assigned DPA can find the safe recovery entry and continue the existing auditable run after the underlying issue is fixed.