Active executions, queued work, unresolved incidents, and active records are not purged by the retention worker. Billing and invoice reconciliation follow financial-record handling rather than customer-configurable purge.
Account export
GET /v1/account/export returns versioned account metadata, memberships, sessions without device keys/IP metadata, invitation history, credential metadata without hashes/plaintext, personal workflow metadata without encrypted content, and attributable audit events. Secret values, token hashes, protected-variable ciphertext, and raw webhook payloads are excluded.
Account deletion
DELETE /v1/account requires fresh interactive passkey/MFA and refuses while the account owns an organisation or is the sole human owner of an active service account. It revokes credentials/runners, removes sessions and memberships, pseudonymizes identity, and cryptographically erases personal workflow ciphertext/key envelopes while retaining required referential evidence.
Object storage, worker disks, and backups must use limits no longer than the corresponding database data class.