Need to remove a user, but need to know if i can delete or have to make inactive based on the entries they have input into eramba. Will those inputs remain? Will those comments and reviews remain? If they are the POC assigned, how will that be affected?
documentation: Access Management
I came across this thread by coincidence, but it’s a really important topic in my view. The page you linked to says:
Deleting Accounts
If you delete an account that has items (Risks, Controls, etc.) assigned to the system, those items will become owned by the “Admin” user account.
This raises a few questions for me — particularly around accountability and traceability. What happens to all other areas where that user’s input matters, such as reviews they performed or comments they left?
Are these also reassigned to “Admin,” or are they deleted entirely? Personally, I would expect an ISMS/GRC system — where traceability of decisions and actions is critical — to preserve the original name of the user who performed an action, even after their account is deleted.
It would be great to get some clarification on how this works.
yes, we are working on that, is now gone to “Admin” - which is not ok. We will be testing fixes next week and then we will have more updates.
Thanks for picking this up!
I hope you guys are progressing on this topic.
I also wanted to add something I just noticed as it seems related:
I noticed some old comments are by “Unknown User” which seems to indicate a user which has been deleted. This also muddies the topics of accountability and traceability, please consider handling this differently, maybe keep the name and add (deleted) behind it?
yes is also being taken into consideration, we are working on this stuff as I write here
Is there an update to this?
I created an account, wrote a comment and deleted the account.
I wouldve expected it to say unknown user too. Is there any documentation on those? Are there settings for deletion and what happens after a user is deleted? Stays x days for instance? Or is this done by the logging number?
This is addressed in version 3.31 for comments: the author’s name is now stored with the comment and remains visible after their account is deleted.
However, older comments that already lost their author information may still show “Unknown User”—the upgrade cannot recover names that were not retained.
The “Deleted User” label is not yet consistent across all views. The broader handling of ownership and review attribution also has some remaining limitations, so this does not fully resolve every traceability concern raised in this thread.
Perfect, thank you. Will have a look. Still wonedering if there is a setting, that deletes/anonymises comments after x years?
Hello,
unfortunately no, there is no such setting.