Deleting data
You can delete a project, a whole organisation or your own account from the console, at any time and without asking us. Each deletion asks you to type the name (or your email address) back and needs a sign-in from the last 15 minutes; if yours is older, the console asks you to sign in again first. Every deletion is written to the console audit log.
| What | Who | Where in the console |
|---|---|---|
| A project | An owner of its organisation | Project, Settings, Delete project |
| An organisation, with all its projects | An owner | Project, Settings, Delete organisation |
| Your account | You | Account menu, Account, Delete account |
What is deleted #
Deleting a project removes, at once:
- every record of the project in both environments: envelopes (agent names, tool names, times, sequence numbers, references), content hashes, signatures and any stored content
- its receipts, batches and the signed heads given with them
- its agents and their public keys
- its API keys, which stop working immediately
- its auditor links, alert settings, rejection and conflict counts, experiments and audit packs
- its usage counts, its sandbox data keys, and the product analytics kept about it (API request events, milestones and daily counts that name the project)
Deleting an organisation deletes each of its projects as above, and also its members, pending invitations, plan and billing details held by us, metered usage reports, customer-managed keys, SSO configuration and identities, stored-content data keys and its console audit log. If the organisation has a Stripe subscription, it is cancelled first; the metered overage subscription is invoiced for what it measured. If Stripe does not confirm the cancellation, nothing is deleted and you can try again.
Deleting your account removes your user record, sessions, memberships, SSO identities, sign-in links and invitations sent to your address. Your email address is removed from every console audit log entry and replaced with "[deleted user]" where it appeared in an entry's details. Organisations where you are the only member are deleted with the account, as above; the console lists them before you confirm. If you are the only owner of an organisation that has other members, make someone else owner, or delete the organisation, first. Auditor links and audit packs you created keep working, without your name.
What is kept #
Only what other customers' proofs and the published timestamps point into:
- For each batch of the deleted project that was already anchored: the batch hash (a SHA-256 hash), its position in the anchor's Merkle tree and its Merkle path. They name no project, environment, agent, record or person, and cannot be turned back into a record.
- The anchors themselves (the Merkle root, its signature and its public timestamp proof), and the service key history. These cover many customers' batches at once.
- One audit log entry for the deletion (
project.delete,org.deleteoraccount.delete), with the time. For a project or organisation it names the owner who deleted it; an account deletion names no one.
Hashes already submitted to public timestamp services (one hash per anchor, about one an hour, covering many customers) are held by those services and by the public ledger behind them. They are permanent and cannot be withdrawn by anyone, and they reveal nothing about your records.
Copies in backups expire on the backup schedule. Stripe keeps invoices and payment records under its own retention and our accounting obligations.
Before you delete #
Deleting cannot be undone. Export what you need first: a verification pack (signafaide export, or the console's Exports page) still verifies offline after the project is gone, because it carries the receipts, keys and anchors it needs. Your local .signafaide/ folder is never touched by a deletion.
The console calls DELETE /api/projects/{project}, DELETE /api/orgs/{org} and DELETE /api/auth/me, each with {"confirm": "<name or email>"}. An old session gets 403 with the code reauth_required.