---
title: "Privacy and compliance controls in Backoffice"
description: "Find every Privacy & Legal and Web Analytics & Privacy page in Backoffice, who can use it, what it records and which docs page explains it."
canonical_url: "https://noxtica.com/docs/compliance/overview/"
markdown_url: "https://noxtica.com/docs/compliance/overview/index.md"
last_updated: 2026-10-27
published: 2026-10-27
section: "compliance"
section_title: "Compliance & Legal"
site: "Noxtica"
language: "en"
source: markdown
---

# Privacy and compliance controls in Backoffice

Backoffice keeps its privacy and legal controls in two sidebar groups: **Privacy & Legal** and **Web Analytics & Privacy**. Use this page as a map. It names each page, says who can open it, what it records and which docs page explains it. A security or privacy owner or a Backoffice administrator uses it to plan a review.

These pages record decisions and settings. They do not give legal advice, and a recorded setting does not make your use of Noxtica lawful. Your counsel decides that. The public legal pages are the sole source for legal terms: [Terms](https://noxtica.com/terms/), [Privacy Policy](https://noxtica.com/privacy/), [DPA](https://noxtica.com/dpa/), [Subprocessors](https://noxtica.com/subprocessors/), [Cookies](https://noxtica.com/cookies/), [Acceptable Use](https://noxtica.com/acceptable-use/), [Disclaimer](https://noxtica.com/disclaimer/) and [Legal notice](https://noxtica.com/legal-notice/).

## What it is

Availability: depends on your plan, role and the modules enabled for your organisation.

The sidebar shows both groups to administrators. A signed-in user with a lower role does not see the entries, and several pages also check a permission on the server. Changes to retention, raw IP storage, legal bases and per-domain consent ask for a fresh multi-factor check (step-up) before they save.

### Privacy & Legal

| Page | What it records or shows | Who can use it | Explained in |
| --- | --- | --- | --- |
| Data Retention | Days that browser intelligence data is kept, the check interval, a read-only retention schedule, a manual "Run retention now" action and the Raw IP storage opt-in. | Administrators. Saving needs step-up. | [Retention, raw IP and locations](https://noxtica.com/docs/compliance/retention-and-locations/) |
| Data Locations | Read-only table of where five kinds of your data are stored. | Administrators see the sidebar entry. The data is read-only. | [Retention, raw IP and locations](https://noxtica.com/docs/compliance/retention-and-locations/) |
| Compliance | Placeholder rows for compliance documents with disabled Download buttons, and an EU AI Act Article 50 transparency policy for verified AI agents when enabled for your organisation. | Administrators. | [DPA, sub-processors and assurance](https://noxtica.com/docs/compliance/assurance-and-subprocessors/) |
| Legal Basis Register | Versioned records of the legal basis your organisation asserts as controller for each gated feature, plus the per-domain Replay legal basis. | Administrators. Recording needs step-up. | [Legal basis register](https://noxtica.com/docs/compliance/legal-basis/) |
| Data Subject Scope | Read-only explanation of the decisions that belong to your visitors. Its links lead to controls that switch collection off or withdraw an assertion, never to a control that switches something on. | Administrators. | [Requests and deletion](https://noxtica.com/docs/compliance/requests-and-deletion/) |
| Sub-processors | Whether your organisation accepted the AI assistant as a sub-processor for write actions. | Administrators. | [DPA, sub-processors and assurance](https://noxtica.com/docs/compliance/assurance-and-subprocessors/) |
| Platform Assurances | Read-only statements of what Noxtica remains responsible for. Nothing to switch. | Administrators see it in the sidebar. | [DPA, sub-processors and assurance](https://noxtica.com/docs/compliance/assurance-and-subprocessors/) |

### Web Analytics & Privacy

| Page | What it records or shows | Who can use it | Explained in |
| --- | --- | --- | --- |
| Consent & Privacy | Per domain: the legal basis for real-user monitoring, whether visitors must consent, and the Do Not Track (DNT) and Global Privacy Control (GPC) policy. | Administrators. Saving needs step-up. | [Legal basis register](https://noxtica.com/docs/compliance/legal-basis/) and [Cookies and storage](https://noxtica.com/docs/compliance/cookies-and-storage/) |
| RUM Collection | Workspace switch for real-user monitoring and a sample rate per domain. | Administrators. | [Real user monitoring](https://noxtica.com/docs/observability/rum/) |
| Tracking Allowlists | Per domain: which custom events and properties are accepted and which origins may be traced. | Administrators. | [Custom events and tracing](https://noxtica.com/docs/observability/events-and-tracing/) |
| Capture Policies | Per domain: replay sampling, masking and retention, and console-log capture. | Administrators. | [Session replay](https://noxtica.com/docs/observability/session-replay/) and [Errors and console logs](https://noxtica.com/docs/observability/errors-and-source-maps/) |
| RUM Data Lifecycle | What real-user monitoring data you hold, the error-detail retention per domain, and a permanent purge per data lane. | Administrators. | [Retention, raw IP and locations](https://noxtica.com/docs/compliance/retention-and-locations/) |
| Uptime Checks | Scheduled HTTPS checks of endpoints you prove you own. | Administrators. | [Uptime checks and status](https://noxtica.com/docs/observability/uptime-alerts-status/) |

### Related pages outside these two groups

| Page | Where | What it is for | Explained in |
| --- | --- | --- | --- |
| Data Operations | Backoffice → Administration → Data Operations | Soft-delete end-user data, run retention now, remove admin accounts, read the operations history. | [Requests and deletion](https://noxtica.com/docs/compliance/requests-and-deletion/) |
| KYC Verifications and KYC Erasure Requests | Backoffice → Identity Verification → KYC Verifications and KYC Erasure | The two Backoffice routes that delete identity verification data: administrators delete verifications directly, and erasure requests are approved by a second administrator. | [Requests and deletion](https://noxtica.com/docs/compliance/requests-and-deletion/) and [Verification data](https://noxtica.com/docs/identity-verification-data/) |
| Legal basis for hosted verification | Backoffice → Identity Verification → KYC Invitations → Settings | Records the legal basis that hosted verification needs. | [Invitations and hosted settings](https://noxtica.com/docs/identity-verification-invitations/) |
| CSP & storage tab | Backoffice → Integrations & API → Script & Consent → CSP & storage | The cookie and storage table to copy into your cookie policy. | [Cookies and storage](https://noxtica.com/docs/compliance/cookies-and-storage/) |
| Privacy & cookies | Backoffice → Settings | Your own choice, as a signed-in user, whether Noxtica's consent-gated extensions run on the Backoffice console. | [Cookies and storage](https://noxtica.com/docs/compliance/cookies-and-storage/) |

Identity verification data follows a separate rule. Noxtica does not remove verification details or evidence by itself and sets no retention date for them. They stay until a tenant administrator deletes them. The Data Retention page applies to browser intelligence data and never touches verification records.

### Four separate legal-basis records

Backoffice keeps four kinds of recorded basis. A record of one kind never covers another.

| Record | Scope | Where you record it | What it gates |
| --- | --- | --- | --- |
| Register entry | Your workspace, one entry per gated feature | Privacy & Legal → Legal Basis Register | The gated feature named by the entry |
| Replay legal basis | One domain | Privacy & Legal → Legal Basis Register, section Replay legal basis | Turning on session replay for that domain |
| Consent & privacy decision | One domain | Web Analytics & Privacy → Consent & Privacy | Real-user monitoring, error-detail and console-log capture on that domain |
| Hosted verification legal basis | Your workspace | Identity Verification → KYC Invitations → Settings | Minting and submitting hosted verification sessions |

## Prerequisites

- A Backoffice account with the administrator role for your workspace. See [Roles and permissions](https://noxtica.com/docs/security/roles-and-permissions/).
- A multi-factor method enrolled on your account, because saving most of these pages asks for a fresh check. See [Sign-in and access](https://noxtica.com/docs/security/sign-in-and-access/).
- At least one domain added to the workspace for the per-domain pages. See [Domains](https://noxtica.com/docs/backoffice/domains/).
- Identity verification pages appear when the module is enabled for your organisation.

## Steps

### 1. Open the groups

Sign in at `https://backoffice.noxtica.com`. In the sidebar open **Privacy & Legal** and then **Web Analytics & Privacy**. If an entry is missing, your role is below administrator.

### 2. Set retention and raw IP storage

Open **Privacy & Legal → Data Retention**. Review the retention schedule and the Raw IP storage setting. Details are in [Retention, raw IP and locations](https://noxtica.com/docs/compliance/retention-and-locations/).

### 3. Record legal bases for the features you use

Open **Privacy & Legal → Legal Basis Register**. Record a basis for each gated feature you turn on, and record the Replay legal basis before you enable replay on a domain. Details are in [Legal basis register](https://noxtica.com/docs/compliance/legal-basis/).

### 4. Resolve per-domain consent decisions

Open **Web Analytics & Privacy → Consent & Privacy**. Decide the legal basis, the consent requirement and the DNT and GPC policy for each domain that collects real-user monitoring data.

### 5. Set capture policies

Open **Web Analytics & Privacy → Capture Policies**. Choose replay sampling, masking and retention and the console-log setting for each domain.

### 6. Publish your cookie disclosure

Open **Integrations & API → Script & Consent → CSP & storage**. Copy the storage table into your cookie policy. See [Cookies and storage](https://noxtica.com/docs/compliance/cookies-and-storage/).

### 7. Know your deletion and assurance routes

Read [Requests and deletion](https://noxtica.com/docs/compliance/requests-and-deletion/) and [DPA, sub-processors and assurance](https://noxtica.com/docs/compliance/assurance-and-subprocessors/) before a request or a procurement review arrives.

## Verify it works

- **Consent & Privacy** shows an "All resolved" badge and the line "No domain has an unresolved consent or privacy decision."
- **Legal Basis Register** shows the status "Asserted" and a receipt line for each basis you recorded.
- **Data Retention** lists the retention schedule with a Source badge for each row: "Your override", "Plan default" or "Default".
- **Raw IP storage** shows the badge "Disabled" or "Enabled" and the time of the last change.
- Every save above appears in the audit log. See [Audit log and data export](https://noxtica.com/docs/security/audit-log-and-exports/).

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| The Privacy & Legal group is missing from the sidebar. | The sidebar hides these entries from roles below administrator. | Ask an administrator of your workspace, or ask for the administrator role. |
| Legal Basis Register shows an error instead of the gates. | The register needs the permission to record legal bases, which is administrator level. | Sign in as an administrator. |
| A save asks you to verify again. | Retention, raw IP, legal basis and consent decisions need a fresh multi-factor check. | Complete the prompt. Cancelling changes nothing. |
| The Compliance page has Download buttons you cannot press. | The rows are placeholders. The tooltip says compliance documents will be provided through the customer success portal. | Ask your account team. Do not treat the rows as evidence that a report exists. |
| The EU AI Act card is missing from Compliance. | The card shows when the policy is enabled for your organisation. | Ask your account team whether it applies to you. |
| No identity verification retention note appears on Data Retention. | The note appears when the identity verification module is enabled for your organisation. | Enable the module through your account team. |

## Related

- [Legal basis register and receipts](https://noxtica.com/docs/compliance/legal-basis/): record, change and withdraw a legal basis.
- [Data retention, raw IP storage and data locations](https://noxtica.com/docs/compliance/retention-and-locations/): retention controls and where data lives.
- [Data subject scope, erasure requests and account deletion](https://noxtica.com/docs/compliance/requests-and-deletion/): deletion routes.
- [Cookies, storage and consent categories](https://noxtica.com/docs/compliance/cookies-and-storage/): what the SDK writes in a visitor's browser.
- [DPA, sub-processors, DPIA pointers and assurance](https://noxtica.com/docs/compliance/assurance-and-subprocessors/): public documents and assurance pointers.
- [Security and trust evidence](https://noxtica.com/docs/security/): what Noxtica publishes about its security posture.