Environment deletion and key destruction

Each KeenAuth environment has its own encryption keys. When an environment is deleted, KeenAuth destroys those keys, so the environment's data becomes permanently unreadable, also in places where an encrypted copy still exists for a while, such as backups. This page explains what is destroyed, when, and what remains. Parts that are not available yet are marked planned.

The key hierarchy

Sensitive fields of an environment (for example MFA secrets, token signing keys, connection and webhook secrets, personal data in logs, log archives and export files) are encrypted with data keys. Those data keys are wrapped by the environment's own tenant master key, and the tenant master key is wrapped by a key of the KeenAuth cell where the environment lives. The cell key never leaves the cell's key management system and cannot be exported.

• Every environment has its own tenant master keys, one for each KeenAuth service that stores encrypted data; no key is shared between environments, also not between environments of the same account.
• The storage provider's own encryption is not relied on: data is encrypted by KeenAuth before it is written.

What happens when an environment is deleted

1. Keys are destroyed first. Every tenant master key of the environment is marked destroyed and its wrapped key material is erased. A record that the key existed and was destroyed is kept, without the key.
2. Live data is deleted. The environment's users, organizations, applications, sessions, logs and other records are deleted from the live databases.
3. Email signing keys are deleted. The DKIM signing keys of the environment's sending domains are removed from the cell's key management system in the same step.

After step 1, no running KeenAuth system can decrypt the environment's encrypted fields, even before the rows themselves are gone.

Backups and the 30-day limit

Database backups and key management snapshots can still contain a wrapped copy of a destroyed key. They are kept for at most 30 days. When the last backup that contains the key has expired, every encrypted copy of the environment's data (in backups, archives and leftover export files) is permanently undecryptable.

• If a backup is ever restored, deleted environments are removed again before the restored system goes online (planned).
• A deletion certificate that lists the destroyed key versions and the date the last backup expired is produced after the 30 days (planned).

Legal hold

If an environment is under a legal hold, key destruction is postponed until the hold is lifted and then happens within 24 hours (planned).

Deleting an environment

Deleting and restoring environments from the dashboard and the management API is planned. Until then, contact KeenAuth support to delete an environment.