31a. Delete a tenant (tenant owner or system administrator)

Tenant deletion is allowed for two kinds of users:

  • The tenant owner — the user who created the tenant (and any user the ownership has been transferred to since).
  • A system administrator — any user with the delete tenant permission.

Tenant deletion is a two-step process designed so misclicks are recoverable.

Soft delete (the first step). Open System → Tenants in the sidebar, find the tenant in the table, and click the red × delete icon. You're taken to a confirmation page that lists exactly what's about to happen and how long you have to change your mind. To enable the Delete tenant button, type Delete! (with the exclamation mark, exact case) into the confirmation input. Click Delete tenant.

After delete, the tenant doesn't disappear from the system — it sits in a "Pending purge (30 days)" state. Its users lose access immediately, but its data, files, and audit history are preserved for 30 days. The tenant row stays visible on System → Tenants with a yellow "Pending purge" badge and a green Restore icon next to the delete icon.

Restore within the 30-day window. If you change your mind, click the green undo icon on the soft-deleted row. The tenant flips back to active and its users can sign in again.

Permanent deletion (the second step). After 30 days, the nightly tenants:purge maintenance job permanently drops the tenant's database, removes the files from storage, and writes the final audit entry. From this point the tenant is gone — only an export zip can bring it back, and even then it lands as a brand-new tenant with a fresh ID.

Tip: before clicking delete, toggle Start a full export before deleting on the confirmation page. The system will produce a zip with every table and every file, then email you a signed download link. The link stays valid for 30 days.

Delegate ownership instead of deleting (owners only). If you don't want to delete the tenant but you also don't want to keep being the owner, the delete-confirm page also offers a "Delegate ownership to another member" option. Pick any user currently attached to the tenant and click Transfer ownership. From that moment, the new owner takes over delete authority; you remain a member but can no longer delete the tenant. The delegate option is visible only when you are the current owner — system administrators don't see it (they go straight to the delete path).