Account Export and Erasure

Synced with starter commit 7d452a6. Review this technical workflow and its retention settings with counsel before production.

A Tested Data Inventory

src/config/account-data-policy.ts assigns every database table one disposition: delete, pseudonymize, retain, or not personal. It also states whether the table is included in an export. A test compares the policy with src/db/schema.ts, so adding a table without making a privacy decision fails the build.

Credentials, password hashes, sessions, verification tokens, and TOTP secrets are never exported. Financial, audit, ledger, and shared-workspace records may remain after irreversible identifiers are replaced.

Requesting an Export

POST /api/account/data-export requires authentication, same-origin protection, rate limiting, and an Idempotency-Key. It returns 202 and queues account_data_export.

Poll GET /api/account/data-export/{requestUuid}. When complete, the response contains a five-minute signed manifest URL and signed links to active private files. Export artifacts are private and expire after seven days by default.

Requesting Erasure

POST /api/account/deletion uses the same controls and additionally requires a session created within the last 15 minutes. The default seven-day grace period allows cancellation with DELETE /api/account/deletion; GET returns status.

The request is blocked when the account is the last owner of a shared organization or the last full-access administrator. Transfer ownership or promote another administrator first.

After the grace period, the durable worker:

• revokes sessions and removes authentication credentials;
• cancels subscriptions and optionally deletes the Stripe customer;
• deletes solo-workspace objects and external task outputs through provider adapters;
• removes memberships, invitations, feedback, and other deletable records;
• pseudonymizes retained orders, credits, subscriptions, reservations, audit records, and shared-workspace ownership;
• cancels or scrubs queued jobs;
• records each external effect so retries cannot claim work that did not happen.

Policy You Must Review

src/config/account-lifecycle.ts controls the grace period, export retention, fresh-session window, Stripe-customer deletion, security-blocklist retention, and signed-download lifetime.

The shipped defaults are technical choices, not legal advice. Align them with the privacy policy in src/config/legal.ts, your provider contracts, tax/financial retention duties, and the jurisdictions where you operate.

Production Checklist

1. Keep private storage and the job runner configured; both workflows depend on them.
2. Implement any external-data deletion hook you add to a new provider.
3. Add every new table to the data policy in the same change.
4. Test export, cancellation during grace, owner-transfer blockers, retry safety, and final erasure against a disposable account.
5. Never log export payloads, credentials, or signed download URLs.