# Environment deletion and key destruction

Each KeenAuth environment has its own encryption keys. When an environment is deleted, KeenAuth destroys those keys, so
the environment's data becomes permanently unreadable, also in places where an encrypted copy still exists for a while,
such as backups. This page explains what is destroyed, when, and what remains. Parts that are not available yet are
marked `planned`.

## The key hierarchy

Sensitive fields of an environment (for example MFA secrets, token signing keys, connection and webhook secrets,
personal data in logs, log archives and export files) are encrypted with data keys. Those data keys are wrapped by the environment's own tenant master key, and the tenant master key is
wrapped by a key of the KeenAuth cell where the environment lives. The cell key never leaves the cell's key management
system and cannot be exported.

- Every environment has its own tenant master keys, one for each KeenAuth service that stores encrypted data; no key is
  shared between environments, also not between environments of the same account.
- The storage provider's own encryption is not relied on: data is encrypted by KeenAuth before it is
  written.

## What happens when an environment is deleted

1. **Keys are destroyed first.** Every tenant master key of the environment is marked destroyed and its wrapped key
   material is erased. A record that the key existed and was destroyed is kept, without the key.
2. **Live data is deleted.** The environment's users, organizations, applications, sessions, logs and other records are
   deleted from the live databases.
3. **Email signing keys are deleted.** The DKIM signing keys of the environment's sending domains are removed from the
   cell's key management system in the same step.

After step 1, no running KeenAuth system can decrypt the environment's encrypted fields, even before the rows themselves
are gone.

## Backups and the 30-day limit

Database backups and key management snapshots can still contain a wrapped copy of a destroyed key. They are kept for at
most **30 days**. When the last backup that contains the key has expired, every encrypted copy of the environment's data
(in backups, archives and leftover export files) is permanently undecryptable.

- If a backup is ever restored, deleted environments are removed again before the restored system goes online
  (`planned`).
- A deletion certificate that lists the destroyed key versions and the date the last backup expired is produced after
  the 30 days (`planned`).

## Legal hold

If an environment is under a legal hold, key destruction is postponed until the hold is lifted and then happens within
24 hours (`planned`).

## Deleting an environment

Deleting and restoring environments from the dashboard and the management API is `planned`. Until then, contact KeenAuth
support to delete an environment.