Offboarding and deletion
Freeze, delete, and what each one actually does.
Freeze first
Freezing an account revokes access immediately and keeps the record. Their tasks, invoices and messages stay attributed and readable. This is the right action for someone who has left.
A frozen account cannot act on any channel. Revocation happens at actor resolution, so a frozen person messaging Suvi from a bound number gets nothing.
Deletion
Deletion is irreversible and thorough. It exports every row keyed to that user to a verified backup, then hard-deletes across every table in one transaction.
Shared artefacts that others depend on, such as a template the business still uses, are retained with the creator field cleared rather than destroyed.
Deletion cannot be undone
There is a dry run. Use it. It lists exactly what would be removed before anything is.
Deleting your own data
Each person can delete their own data without going through an admin. Owners get the same path plus an instance-level danger zone.
Google data has its own deletion route, which revokes the tokens and purges what was pulled from that account. That is separate from deleting the Suvi account, so you can disconnect Google without leaving.
What deletion covers
Rows keyed to the user, stored media, transcripts and the embeddings derived from them. A deletion receipt records what was removed and when, holding metadata only rather than the content itself.