app.deletion_certificates
TableRow level security on
The record of an org whose data was deleted (Section 14.7): day 90 of a cancellation or the end of a deletion request's recovery window. Kept after the org is gone, so it names the org by id, name and slug with no foreign key. It tracks the purge (storage objects, then every row through the tenant purge), the certificate PDF and its email to the former Owner. Written only by the lifecycle job and the org-lifecycle worker; the former Owner reads their own.
Primary key: id
| Column | Type | Nullable | Description |
|---|---|---|---|
| id | uuid | No | Certificate id, printed on the PDF. |
| deleted_org_id | uuid | No | Id the org had. No foreign key: the org row is deleted. |
| org_name | text | No | Name of the org when it was deleted. |
| org_slug | text | No | Web address of the org when it was deleted. |
| basis | text | No | cancellation (day 90 of a cancellation) or deletion_request (end of the 7-day recovery window). |
| requested_at | timestamp with time zone | No | When the Owner canceled or asked for deletion. |
| due_at | timestamp with time zone | No | When the data became due for deletion. |
| owner_person_id | uuid | Yes | Former Owner the certificate goes to; null once their own account is deleted.References app.people.id |
| owner_name | text | Yes | Name of the former Owner when the certificate was written. |
| owner_email | text | Yes | Address the certificate is emailed to, kept with the certificate as delivery evidence. |
| locale | text | No | Language of the certificate and its email: the Owner's language in the org, en-US or es-US. |
| time_zone | text | No | The org's time zone when it was due (its locale.time_zone setting, UTC unset): the calendar the certificate and its email date the deletion on. |
| held_at | timestamp with time zone | Yes | When a legal hold was found on the org; the purge waits while it is set. |
| blocked_reason | text | Yes | Why the purge refused, for example rows of another org that reference this one; the platform resolves it. |
| storage_cleared_at | timestamp with time zone | Yes | When the worker found no storage object of the org left after deleting them through the Storage API. |
| storage_objects_deleted | integer | No | Storage objects the worker deleted. |
| purged_at | timestamp with time zone | Yes | When every row of the org was deleted. |
| tables_purged | integer | Yes | Tables rows were deleted from. |
| rows_purged | bigint | Yes | Rows deleted. |
| document_object | text | Yes | Object name of the certificate PDF in the private deletion-certificates bucket. |
| document_sha256 | text | Yes | SHA-256 of the certificate PDF. |
| issued_at | timestamp with time zone | Yes | When the certificate PDF was stored. |
| delivered_at | timestamp with time zone | Yes | When the certificate was emailed to the former Owner. |
| delivery_message_id | text | Yes | Message id the mail provider returned. |
| attempts | smallint | No | Worker attempts so far. |
| locked_by | text | Yes | Worker that holds the certificate while it works on it. |
| locked_at | timestamp with time zone | Yes | When the worker claimed it. |
| last_error | text | Yes | Error of the latest failed attempt. |
| created_at | timestamp with time zone | No | When the row was inserted. Set by the database. |
| created_by | uuid | Yes | Person who inserted the row, or null for a platform process. Set by the database.References app.people.id |
| updated_at | timestamp with time zone | No | When the row last changed. Set by the database. |
| updated_by | uuid | Yes | Person who last changed the row, or null for a platform process. Set by the database.References app.people.id |
| deleted_at | timestamp with time zone | Yes | Soft delete time. A row with deleted_at set is ignored by every access helper. |