Security & compliance
Data subject requests: intake, hold and what erasure removes
A data subject request has a lifecycle, a legal-hold gate, and a fulfilment step whose exact scope matters. This guide is specific about what an erasure removes and what the append-only audit log keeps, redacted, because it is never deleted.
Open Data subject requests in the consoleIntake, hold, fulfilment
A request moves from intake, through any legal hold that applies, to fulfilment. A hold is a real gate: while one is in force, fulfilment does not proceed.
What an erasure actually removes
Erasure deletes the subject's own records and lets foreign-key cascades remove what hangs off them. Organization-level deletion works the same way, at a larger scope.
Legal hold
A hold is a real gate, not an annotation. While one is in force on a subject's data, fulfilment does not proceed — which is the behaviour a retention obligation requires, even when it conflicts with a deletion request.
Organization-level deletion
Deleting an organization is the same mechanism at a larger scope: the organization row is deleted and foreign-key cascades remove what hangs off it across every tenant-owned table. It is genuinely a delete, not a flag.
Put it into practice
Run a fleet with these guardrails on from day one.
Hard cost caps, one audited gateway in front of every tool call, and versioned rule files — the defaults, not an enterprise add-on.