Skip to main content

Documentation Index

Fetch the complete documentation index at: https://grantmaster.dev/llms.txt

Use this file to discover all available pages before exploring further.

​
Data Retention and Offboarding

This document defines the lifecycle of tenant data, from active usage to permanent deletion (the “Right to be Forgotten”).

​
🏗️ Purge Lifecycle Visual

​
📅 Retention Strategy

GrantMaster operates on a “Minimum Necessary” data retention policy.
Data TypeRetention PeriodRationale
Active Pursuit DataIndefiniteRequired for ongoing grant management.
User Activity Logs1 YearSecurity auditing and troubleshooting.
Soft-Deleted Files30 DaysSafety net for accidental deletion.
Stripe Billing Data7 YearsLegal and tax compliance.

​
🚪 Tenant Offboarding Process

When a tenant cancels their subscription, the system initiates the Permanent Purge sequence.

​
Stage 1: Suspension (Day 1-30)

  • Access to the platform is revoked.
  • The tenants/{id} document is marked status: 'suspended'.
  • Data is still retrievable by SuperAdmins in case of a reactive subscription.

​
Stage 2: Soft Deletion (Day 31-60)

  • The tenants/{id} document is marked status: 'deleted'.
  • The tenant is hidden from all admin lists.
  • Background workers begin unlinking cross-tenant relations.

​
Stage 3: Hard Deletion (Day 61+)

  • Firestore Shredding: The shredder function iterates through all collections where tenantId == {id} and deletes all documents.
  • Storage Wipe: The deleteTenantAssets function purges the {tenantId}/ folder in Cloud Storage.
  • Encryption Key Rotation: The tenant-specific encryption key in GCP Secret Manager is scheduled for deletion.

​
🧹 Manual “Right to be Forgotten” (RTF)

Users may request individual data deletion under GDPR. SuperAdmins must execute the rtf-user-cleanup script: 
# Example command
npm run script:rtf -- --uid="USER_ID" --tenantId="TENANT_ID"
This script:
  1. Redacts the user’s name and email in all Efforts and Comments.
  2. Deletes the users/{id} document.
  3. Anonymizes the user in analytics logs.

​
🛡️ Data Sanitization standard

We use Logical Deletion (flagging) for day-to-day operations and Physical Deletion (shredding) for offboarding. Once a “Hard Delete” is processed, data recovery is impossible.