Tenant administration

QUORUM REQUIRED · 06:44 PM

Tenant offboarding — irreversible

Quorum-of-2: two distinct platform admins must each POST within a 1-hour window before the workflow actually starts. Once started, the tenant transitionsACTIVE → FROZEN → export bundle assembled →OFFBOARDING → tenant-wide RLS erasure. This cannot be undone after the second quorum signature.

See docs/runbooks/tenant-offboarding.md for the operator checklist (DPO sign-off, export verification, KMS key revocation).

Start an offboarding

Tenant ID

Reason

I understand this is irreversible after the second quorum signature and that the tenant's data will be erased.