阅读中文版本

Tenant Offboarding and Data Deletion Workflow

Export the tenant data for the customer, confirm the retention or deletion request, remove data across all systems and backups, and produce an attestation.

Overview

Offboard a tenant by exporting what must be returned and deleting what must not be retained, with proof. Verify each system in the inventory reports zero remaining records and that the attestation references the exact scope and dates.

Steps

1. Export the tenant data in a portable format for the customer. Expected state: The customer has their data.
2. Confirm the deletion versus retention decision in writing. Expected state: The action is authorized and recorded.
3. Delete tenant data across primary stores, caches, and derived systems. Expected state: No live copy remains.
4. Expire or redact backups per policy and issue an attestation. Expected state: Backups do not silently keep data forever.

await exportTenant(tenantId, { format: 'ndjson' });
for (const system of tenantSystems) {
  await system.purge(tenantId);
}
await attestDeletion(tenantId, { scope: tenantSystems, maxBackupLagDays: 35 });

Verification

• Tenant data is exported where required, deleted where required across all systems including backups per policy, and an attestation is recorded.

Decision points

• Delete from backups immediately or wait for expiry? Options: Wait for retention expiry; Immediate rewrite. Recommended: Immediate rewrite of backups is expensive and itself risky; expire per policy with a documented maximum lag.
• Question the deletion scope? Options: All systems; Only the primary database. Recommended: All systems that hold tenant data, or the deletion is incomplete and unprovable.