The customer’s administrator, on one screen with no code and no ticket. The safest setting is the default.
Your administrator decides what may be read, what is excluded and how long anything is kept, on one screen with no code and no ticket.
The safest setting is the default for every one of them. Unreviewed contacts, for example, are deleted after ninety days unless the customer chooses otherwise.
Changes are recorded in the append-only log, so every setting can be explained later. See RelationLens.