Deletion and Export

Version 1.0, approved 2026-09-21. The export described here is built and tested. Self-service deletion is not yet built; the section on deletion describes the operator-run process that exists today, and this page is revised when self-service deletion ships.

Export

An owner or admin can request a complete export at any time from Settings → Your data, or by POST /api/orgs/current/exports with a signed-in session (API tokens cannot request exports).

What you get. A zip archive containing:

• manifest.json — the export's identifier, schema version, the date, a list of every file in the archive with its size and SHA-256 checksum, a row count for every table, and a list of anything expected that could not be included.
• data/ — one JSON-lines file per table: your organisation (including the kind you declared at signup), members, invitations, documents and their versions, recipients, fields, sections, comments, signature records, audit events, email delivery events, envelopes, templates and their roles, fields and sections, public links, contacts, webhooks and their deliveries, API tokens, storage and DocuSign connections, archive targets, subscription, entitlement overrides, usage periods, nonprofit verification records and events, and the ledger of stored files.
• objects/ — every file the organisation holds: PDFs in every state, signature images, attachments, responsive renderings, template PDFs and version snapshots.

What is deliberately not in it.

• Credentials of any kind: signing-link tokens, webhook secrets, API token hashes, invitation tokens, and the encrypted OAuth tokens of connected integrations. An API token's last four characters are included so you can recognise which is which.
• Nonprofit verification letters. The verification record is included; the letter is restricted to reviewers and is deleted on its own 90-day schedule.
• Other exports.

Completeness is checked, not assumed. The export is marked complete only when every file the ledger says you hold was found and its checksum recorded. If anything is missing, the export is marked as not complete and the manifest names each missing file; you are not shown a download that is quietly short.

Access. One export may be in progress at a time and two may be requested per day. The archive is available for 24 hours; each download link is valid for 60 seconds and is issued only to an owner or admin. Every request, completion, download and expiry is written to the operator audit log with the requesting person's identity.

Bounds. A single archive is limited to 1 GB uncompressed. An organisation above that will be offered a staged export by support: the archive is split by document date range into separate archives, each with its own manifest, so that the manifests together list every file exactly once.

Deletion

Deleting documents

A member with document access can delete a document. Its records are removed; its files are removed when nothing else still refers to them (a template shares its PDF with the documents made from it). The document's audit trail is removed with it.

Deleting your account

Write to privacy@escryber.com from the account's email address. Until self-service deletion ships, an operator performs the deletion, records it with a reason in the audit log, and confirms to you by email within 10 business days of confirming the request.

If you are the only owner of an organisation, deleting your account means deleting the organisation; see below.

Deleting your organisation

An owner may request deletion of the whole organisation at the same address. Before deleting we:

1. Confirm the request with every owner of the organisation.
2. Offer an export, and wait 14 days for it to be taken.
3. Cancel the subscription at Stripe.
4. Delete the organisation. Every record in the data map's classes 2–10 is removed, and every file whose only owner was this organisation is removed from storage.

What is kept after deletion, and why

Kept	Why	For how long
The nonprofit fingerprint: a keyed hash of the EIN with the verification decision, date and reviewer	So that a first-year founding offer, which is one per legal entity, cannot be claimed again by re-registering (decisions D08, D09)	24 months after the organisation is deleted
Founding-offer redemption record	Same	Same
The trial's redemption record: keyed hashes of the mailbox and origin network address that started a trial, with the outcome	So that the one trial per organisation cannot be recreated by deleting the account and registering again (decision D18)	24 months after the organisation is deleted, the same as the fingerprint
Operator audit log entries about the organisation (including the deletion itself)	The log is hash-chained; removing entries would defeat its purpose	Indefinitely
Stripe's own records of invoices and payments	Stripe's legal obligations as a payment processor	Per Stripe's policy
Email suppression: an address that reported our mail as unwanted	So we do not email it again	Indefinitely
Data under a legal hold	Legal obligation; you are told unless the law prevents it	The duration of the hold
Backups	A deleted record persists inside encrypted backup bundles until they are overwritten	35 days for the off-host copy, 14 nightly copies on the host, per the retention policy

Nothing else is kept. Recipients' documents that were sent to them by a deleted organisation are deleted with the organisation; recipients who need a copy should download it before the organisation is deleted.

Recipients asking for deletion

If you signed a document and want your data removed, write to privacy@escryber.com. Because the sending organisation controls the document, we will involve them. Signed documents are records of an agreement between you and them, and there may be a legal basis for keeping the document itself — a signed agreement is evidence of that agreement for as long as either party may need to rely on it; where a document is kept we can still remove personal data that is not part of the signed record, such as your session details.

Contact

privacy@escryber.com