Offboarding, Export and Deletion

Leaving is part of the product

Tenants leave: contracts end, companies close, free trials lapse. A good offboarding flow usually starts with suspension: users can no longer log in or are read-only, but data is kept for a grace period in case of a mistake or late payment. Next comes export: the customer should be able to download their data in a usable format, which many contracts and privacy laws expect. Then deletion: remove the tenant's rows from every table, its files from object storage, its entries in search indexes and caches, and its secrets and keys. Backups are the hard part, because you usually cannot edit a backup; common answers are a fixed backup retention after which the data ages out, or per-tenant encryption keys that you destroy so old copies become unreadable. Record what was deleted and when, because customers and auditors may ask for proof.

Deleting one tenant from a shared schema

PostgreSQL. Children before parents, all in one transaction, run by a privileged maintenance role rather than the app role.

BEGIN;
DELETE FROM tasks    WHERE tenant_id = '7c1e2d9a-0b4f-4c55-9a51-2f8e3b6d1a10';
DELETE FROM projects WHERE tenant_id = '7c1e2d9a-0b4f-4c55-9a51-2f8e3b6d1a10';
DELETE FROM tenants  WHERE id        = '7c1e2d9a-0b4f-4c55-9a51-2f8e3b6d1a10';
COMMIT;
-- Then: object storage prefix, search index, caches, keys, analytics copies.

Vacating a rented flat

Moving out of a rented flat means a notice period, packing your belongings to take with you, cleaning out every room and handing back all keys. Leaving a spare key under the mat is the equivalent of forgetting the backups.

Inventory every data store

Deletion is only as complete as your list of places data lives. Keep a data map per feature: tables, buckets, indexes, queues, analytics exports, logs. New features must add themselves to the deletion job.

Quick check: Why do some SaaS platforms encrypt each tenant's data with its own key?

• It makes queries faster
• Destroying that key makes the tenant's data in old backups unreadable
• It removes the need for tenant_id columns
• It lets tenants read each other's data safely