Data and privacy
Two rights, both exercised by an organization owner, with deliberately different friction.
Export is easy because getting your own data should be. Erasure is hard because it cannot be undone.
Export
Section titled “Export”An export produces a machine-readable archive of your organization’s data.
It runs as a job rather than a download, because the archive is built rather than fetched. You request it, it is assembled, and you download it through a short-lived link when it is ready.
Secrets do not travel. Credential fields are redacted, and wholly sensitive tables, API keys and identity-provider secrets among them, are excluded entirely. An export is your data, not a copy of your security posture.
Both the request and each download are recorded in the audit log.
Erasure
Section titled “Erasure”Erasure deletes the organization’s data. It is meant to be difficult to trigger by accident, and it is built as a sequence of separate deliberate acts rather than one confirmation dialog.
- Preview it. A dry run shows what would be erased, without erasing anything.
- Request a confirmation code. It is sent to you by email, so triggering erasure requires access to the mailbox and not only to the session.
- Confirm by typing. No single click ends an organization.
- Wait out the grace window. Erasure is scheduled rather than immediate, and an owner can cancel it for thirty days.
- The purge runs. After that, it is done.
The grace window is the real protection. Every step before it guards against a mistake in the moment; the window guards against a decision that turns out to be wrong the next day.
The deletion certificate
Section titled “The deletion certificate”When erasure completes, a signed certificate is produced and retained as evidence that it happened.
It is not shown in the product today. The certificate is available through the API, and the organization receives it out of band. If you need it for a compliance file, ask rather than looking for it on a page.
Before you erase
Section titled “Before you erase”Export first.
Erasure is irreversible and the export path closes with it. The order is obvious in hindsight and easy to get wrong under time pressure, which is exactly when erasure requests tend to arrive.