Deleting your organization

How organization deletion works in RestWard — who may delete, the e-mailed confirmation, the 30-day grace period and restore, what is erased, what is kept (invoices for 5 years), the backup window, and the slug quarantine.

An Administrator of an organization can delete it from the organization's settings. Deletion is a proper erasure with a grace period: the organization becomes read-only immediately, and after 30 days — unless restored — everything belonging to it is permanently erased.

Deleting your organization is irreversible after the 30-day grace period. Request a GDPR report first if you want a copy of your data.

Who can delete

An active Administrator of the organization (the highest organization role). Other roles are refused.
The platform organization itself cannot be deleted.
An organization billed by direct invoice is refused with a "contact us" message: the contract has to be ended by an operator first.

Requesting deletion

In the dashboard, open the organization's Settings and choose Delete organization.
Type the organization's slug to confirm you mean this organization.
A one-time confirmation link is e-mailed to your verified email address (it expires after 1 hour). Open the link and confirm.

The API equivalent is POST /api/v1/organizations/{id}/deletion-requests with the slug, then POST /api/v1/organizations/{id}/deletion-requests/confirm with the token from the e-mail (both return 202). GET /api/v1/organizations/{id}/deletion-request returns the status shown in the banner, including the days remaining. Starting the request twice is idempotent — a double click or a retried request lands on the same deletion.

The 30-day grace period

From the moment the request is confirmed, the organization is inert:

Its APIs stop serving and the dashboard becomes read-only (restore, the GDPR report and billing stay available).
All existing sessions are ended — refresh tokens are revoked, so everyone is signed out.
SCIM provisioning is blocked — your identity provider's provisioning job receives 401 and stops. (Remove the RestWard application in your IdP as well; no SCIM delete fan-out is sent.)
SSO sign-in still works during the grace period, so an organization that only signs in via single sign-on can still sign in to restore it or to download its GDPR report.
The Stripe subscription is cancelled at the end of the current billing period.

All active Administrators receive an e-mail when the deletion is requested (who requested it and when the purge is scheduled), and a reminder on day 25 (five days left), so a request nobody expected is visible to the whole admin team.

Restoring

Any Administrator can restore the organization within the 30 days — from Settings, or with DELETE /api/v1/organizations/{id}/deletion-requests. A restore returns a working organization:

the APIs are redeployed and start serving again;
SCIM tokens are re-enabled (a revoked-then-restored setup works again);
the Stripe cancellation is reversed if the subscription has not already ended. If it did end during the grace period, the restored organization has no subscription and an Administrator chooses a plan through checkout.

A restore attempted after the purge has started is refused with 409 — the database row decides the race, not the click order. If the 30 days run out, the purge runs and cannot be undone.

What is erased, and what is kept

Erased at the purge — everything org-scoped: members and invitations (including the invitees' email addresses), verified domains, database connections and their credentials (encrypted passwords, certificates, wallets), APIs and their runtime routes, API keys, SSO and SCIM configuration, usage counts, sessions, and the organization's own audit entries.

User accounts. A member's user account is erased only if the deleted organization was their only organization; a member of several organizations keeps their account and only loses the membership. The requester receives a completion e-mail at the address recorded before it is erased, stating what was erased and what is kept.

Kept. Invoices and payment records are kept for 5 years from the end of the financial year they relate to, as required by Danish bookkeeping law; everything else is erased 30 days after the deletion request. Subscription records, the payment-provider customer reference and a deletion record (tombstone) are kept for the same period. Security audit events are anonymized — the organization id is replaced by a one-way pseudonym, the user id and free-text details are cleared — and kept under their normal retention.

Slug quarantine. The organization's slug (used in API hostnames) is quarantined for 90 days after the purge and cannot be registered by a new organization during that window, so stale integrations cannot be taken over by a new tenant.

Backups. Encrypted nightly backups are not rewritten. Deleted data remains in backups for up to 22 days (about three weeks) and is gone once the backups holding it are pruned. The private key to open a backup is held offline, so the data in a backup is not usable in the meantime.

Cross-links to in-app help

Deleting your organization — the signed-in, step-by-step version of this flow
GDPR report — download your data before or during the grace period
Single sign-on — SSO sign-in during the grace period
SCIM provisioning — SCIM is blocked from the moment of the request