StrataDocs
↑↓ navigate ↵ open esc close

Organization deletion

Permanently delete your organization and every member's data, with a Kronisys approval gate and a 30-day grace window.

The deletion request lives at Organization Settings → Branding & Policy → Delete organization (a red section near the bottom). Submitting the request requires the Suspend organization permission (canSuspendOrg). Canceling a pending or scheduled deletion requires Manage organization settings (canManageOrgSettings).

The two-signal design

A single click cannot delete your organization. Two signals must both be present and the grace window must elapse:

  1. Customer request — an admin with the Suspend organization permission submits the request from the Delete organization section in Org Settings. Stored as deletion_requested_at on your organizations row.
  2. Operator approval — a Kronisys Inc. operator runs node server/tools/approve-org-deletion.js <org_id> --days=30 after reviewing your request. Stored as deletion_scheduled_at.

Until both timestamps are present and deletion_scheduled_at has passed, the sweeper (cleanupScheduledOrgDeletions, runs every 6 hours) does nothing. Your organization stays fully operational throughout.

This design protects against three failure modes:

  • Accidental delete — a tired admin can't nuke the org with one button click.
  • Social engineering — a compromised admin account cannot fast-track destruction.
  • Compliance theatre — the operator review forces a real "is this the right call" pause and a paper trail.

Requesting deletion

  1. Open Organization Settings → Branding & Policy.
  2. Scroll to the Delete organization section (red header).
  3. Click Request organization deletion….
  4. A modal opens with two fields:
    • Reason for deletion (optional) — free-text. Useful for the operator's review.
    • Type <your org name> to confirm — you must type the org's display name (or domain if no display name) exactly. The Request deletion button stays disabled until the typed text matches.
  5. Click Request deletion.

What happens:

  • The org row gets deletion_requested_at = GETUTCDATE(), deletion_requested_by = <your user id>, and deletion_request_reason = <your reason>. Idempotent — re-submitting just refreshes the reason.
  • An audit entry is written: org.deletion_requested with the typed-confirmation org name and the reason in details.
  • An email goes to support@kronisys.com (or OPS_NOTIFY_EMAIL) summarizing the request and instructing the operator how to approve.
  • The Danger Zone in Org Settings flips to show "Deletion requested, awaiting Kronisys Inc. approval" with the timestamp and your reason.

Operator approval

A Kronisys operator reviews the request, contacts the requester to confirm intent if needed, then runs:

node server/tools/approve-org-deletion.js <org_id> --days=30

This sets deletion_scheduled_at = now + 30 days and writes deletion_approved_by. The Danger Zone now reads:

Deletion APPROVED by Kronisys Inc. — your organization and all data will be permanently deleted on <date> (N days from now).

The grace window can be any number of days — 30 is the default. Operators may extend on request.

Canceling a deletion

You can cancel at any time before the scheduled date passes. There are two distinct cancel buttons depending on the state:

  • Cancel deletion request — before operator approval. Clears deletion_requested_at, deletion_requested_by, deletion_request_reason.
  • Cancel scheduled deletion — after operator approval, before the date passes. Clears the above plus deletion_scheduled_at and deletion_approved_by. Renders as a gold primary button to make the cancel path obvious.

Both paths hit POST /api/admin/org/cancel-deletion, require canManageOrgSettings, and write an org.deletion_canceled audit entry. After cancellation, the Danger Zone resets to the original Request organization deletion… button.

You cannot reverse the deletion once the date passes and the sweeper runs.

The 30-day grace window

During the grace window:

  • Every member can sign in and use Strata normally.
  • Chats, agents, scheduled runs continue exactly as before.
  • The Danger Zone banner is visible to every admin so they know the clock is running.
  • You can cancel at any point.

Use the window to:

  • Run a final admin data export of every user's conversations, messages, and settings.
  • Export the audit log as CSV for your compliance archive.
  • Notify members so they download anything they want to keep.

What is irreversibly removed

When cleanupScheduledOrgDeletions runs after the scheduled date, the sweeper hard-deletes everything in one transaction:

  • The organizations row and every users row in the org.
  • All per-user data: sessions, user_settings, user_extension_permissions, user_db_access, user_skills, extension_tokens, files, conversations, messages_archive, messages_cold, scheduled_agents, agent_runs, and the user's activity_log rows.
  • All org-scoped data: org_roles, db_connections, pending_invites, api_keys, api_key_webhooks (and their delivery records), and the Knowledge Base tables (kb_sources, kb_documents, kb_chunks).
  • After the transaction commits, the sweeper reaps the matching cold-stored message blobs and data-export ZIPs (admin and per-user) from Azure Blob Storage.

There is no soft-delete. There is no recovery. Make sure you have run your final exports.

Note

The audit_log is not purged with the org. Its rows age out separately under your audit retention window, and the sweeper writes one final org-less org.hard_deleted record so the deletion itself stays in the compliance trail. Export the audit log before the date if you need it in your own archive.

Final-export recommendations

A complete final export usually means:

  1. Admin data export for every active user (Org Settings → Branding & Policy → Export organization data, range = "All time"). Email includes a 24-hour signed download link.
  2. Audit log CSV (/admin/audit → Export CSV). Capped at 50,000 rows; if you have more, narrow the date range and export in chunks.
  3. Individual user notice so people can run their own personal data export before the date.

Save all three to your compliance archive before the date passes.

What can go wrong

Error / symptomWhat it means
Type the organization name "<name>" exactly to confirm.The text you typed in the confirmation field does not match your org's display name or domain. Type it literally.
Org not foundThe org row was already deleted by another deletion request that completed.
Permission required: canSuspendOrgYour admin role lacks the Suspend organization permission needed to request deletion.
Permission required: canManageOrgSettingsYour admin role lacks the Manage organization settings permission needed to cancel a request.
Request submitted but no approval after several business daysEmail support@kronisys.com directly. The OPS notification mail may have bounced.
Cancel button missing in the Danger ZoneThe scheduled date has already passed; deletion is in progress and cannot be reversed.
You cancel after approval but before the date and members lose access anywayA different action (admin disabled, role demoted) is responsible. Check the audit log.

See Admin data export for the final export workflow, Audit log for the deletion-request audit trail, and Security overview for the broader retention and erasure model.

Related