Tenant deletion is a workflow, not one DELETE statement. First block new activity and revoke every active credential. Then remove or retain data according to policy while recording each store, backup, export, and encryption key that still contains tenant information.
Last updated: November 11, 2026.
START TRANSACTION;
UPDATE tenants
SET status = 'offboarding', offboarding_started_at = CURRENT_TIMESTAMP
WHERE tenant_id = 42 AND status = 'active';
UPDATE user_sessions SET revoked_at = CURRENT_TIMESTAMP
WHERE tenant_id = 42 AND revoked_at IS NULL;
UPDATE api_keys SET revoked_at = CURRENT_TIMESTAMP
WHERE tenant_id = 42 AND revoked_at IS NULL;
INSERT INTO tenant_offboarding_jobs (tenant_id, state, created_at)
VALUES (42, 'pending', CURRENT_TIMESTAMP);
COMMIT;Make the state transition idempotent and require every write path to reject an offboarding tenant. The queued job can then process slower storage systems without leaving the tenant operational.
Close access before erasing data
The OWASP Multi-Tenant Security Cheat Sheet recommends explicit tenant lifecycle controls. Revoke web sessions, API keys, service credentials, OAuth grants, webhook secrets, and background-job access. The OWASP Session Management Cheat Sheet also recommends server-side session invalidation. Invalidate cached authorization decisions and prevent retries from reopening the tenant.
Keep an audit record of who requested offboarding, who approved it, when access ended, and which steps succeeded. Do not log secrets or deleted personal data. A retry should continue incomplete steps rather than creating another independent deletion process.
Track every retained copy
Inventory primary databases, object storage, search indexes, caches, analytics systems, logs, exports, replicas, and disaster-recovery backups. Each location needs a deletion method or a documented retention deadline. Legal holds and billing records may require narrow retention, but they should not keep the application account active.
Encrypted backups require special care. Do not destroy a tenant-specific key until every encrypted copy that may need restoration has expired, unless cryptographic erasure is the approved deletion method. Record the final purge date and test the workflow with a non-production tenant. Reconcile partial failures until the job reaches a verifiable terminal state.
