Shell.online Account Deletion Trail Management

Description and use

Shell.online securely deletes accounts by anonymizing audit logs, removing related tokens, and transferring ownership, while protecting data with client‑side encryption.

Problem

When a user deletes their account, the system must preserve a secure audit trail of commands typed by that user while ensuring sensitive data is removed and ownership is transferred appropriately.

Outcome

Audit logs remain intact but anonymized, ownership is safely transferred, and the system prevents accidental data leakage or account resurrection.

Workflow

• 1. User navigates to account page and initiates deletion.
• 2. System prompts for typed email confirmation and requires recent sign‑in.
• 3. Server runs a single transaction that: a) removes memberships, login codes, CLI tokens, queued agent commands, sessions, vault key, comments, notifications; b) deletes or reassigns sessions; c) updates audit_events to set actor_email to "deleted account"; d) handles organization‑wide deletion if no other members remain; e) transfers ownership if applicable.
• 4. System records the deleted user ID for 2 hours to block resurrection.
• 5. Backup policy ensures data is purged from backups within 8 days.

Evidence

UPDATE audit_events SET actor_email = 'deleted account' WHERE actor_uid = $1

Source

An account half deleted is worse than either state: it can leave a team with no owner, or a session assigned to nobody.

Source