Export and delete an organization

Who can perform the task

An organization administrator can prepare and verify customer exports. A named service operator and independent verifier perform organization deletion through the controlled exit procedure; there is no self-service delete-organization button in the first-customer product.

Before you begin

Obtain an authenticated exit request and approved retention decision. Confirm legal, audit, litigation, regulator, invoice/tax/bank, incident, and backup requirements. Record separate dates for export review, active service deletion, and backup expiry. Unresolved scope or dates block deletion.

Quick path

1. Stop new filing work and confirm who is authorized to approve the organization exit.
2. Export and verify the data, or give an authenticated instruction to delete without receiving an export.
3. Resolve billing, retention, legal-hold, backup, and active-access obligations.
4. Request the operator-assisted deletion and retain its reference.
5. Verify the deletion outcome and any records or backups that remain under a documented retention rule.

Detailed guidance

1. Revoke pending invitations and stop schedules, reminders, ingestion, new billing, and other writes.
2. If requesting return of data, create a fresh encrypted portable bundle for every filing. Store each unique passphrase separately and record bundle and taxonomy checksums.
3. Download required artifacts, attachments, review/approval evidence, authority receipts, invoices, and reconciliation evidence.
4. Restore a representative bundle sample in a clean approved environment and verify entity, period, values, attachments, audit sequence, snapshot, and regenerated export.
5. Confirm the approved accounting archive contains financial records that must outlive the active SaaS copy.
6. Ask the operator to generate the read-only organization inventory. Review its counts, artifact checks, active jobs, and checksum.
7. After the approved waiting date, confirm the labelled organization, financial archive, deletion reason and backup-expiry date. Confirm either the verified export or your instruction to delete without receiving an export. For the latter, an independent verifier checks your authority and records the instruction before the operator proceeds. Internal identifiers and integrity checks are handled by the operator tooling; you need not calculate them.
8. Retain the value-safe deletion receipt and later backup-expiry evidence.

Choosing deletion without return

An authorized customer can instruct the operator to delete without delivering an export. In that case, steps 2–4 above are not required. The financial archive, legal-hold review, artifact checks, stopped jobs and backup-expiry requirements still apply. The receipt distinguishes a verified export from customer-instructed deletion. Silence alone is not a deletion instruction: expiry-based deletion requires an applicable instruction in the accepted agreement, independently verified by the operator team. A failed export does not count as a verified one. The application does not automatically enforce contractual exit dates.

Expected result

All database-referenced organization objects are checksum-verified and removed before the exact unchanged organization rows. A changed inventory, active job, missing object, failed checksum, incomplete confirmation, or invalid backup date stops deletion. Operator-wide regulatory and approved accounting/bank records remain only under their separate retention policies.

How to verify

Confirm the organization, filings, jobs, downloads, calendar entries, billing views, and artifacts are unavailable. Confirm the deletion receipt says active data was deleted but backups remain pending until the recorded expiry date. After that date, obtain independent storage/key-destruction evidence.

Important limitations

• A portable bundle is customer data and remains subject to retention/deletion.
• Authority portals and recipients are outside the product deletion boundary.
• Active deletion does not erase an independent backup immediately.
• The product cannot determine statutory retention periods.
• Organization deletion is operator-assisted for the first 10 customers; enterprise self-service administration remains deferred.