GDPR erasure — what "30 days" actually means at Axos
Article 17 of the GDPR gives every data subject the right to erasure. That right is unconditional in most of the situations that apply to a consumer SaaS workspace — cancelled subscription, withdrawn consent, no residual legal ground. Axos honours it through the /workspace-deletion flow. The flow includes a 30-day grace period, and it is worth explaining what that number means, because the phrase "30 days" is used loosely across the industry.
Day 0 — Request filed
You enter the workspace email on /workspace-deletion, tick the irreversibility checkbox and submit. A signed confirmation link is emailed to the workspace address, valid for 24 hours. Nothing is deleted yet — the request is filed but unconfirmed.
Day 0 to day 1 — Confirmation
You tap the confirmation link. The workspace is marked "pending erasure" and enters a suspended state: no reads, no writes, no sync sockets. The workspace still exists on the primary store; only the surface is disabled. This gives you a whole day to recover from a spoofed request that used a compromised email — signing in during this window cancels the erasure automatically.
Day 1 to day 30 — Grace period
Twenty-nine days of grace, during which you can sign in from any browser to cancel the erasure and reinstate the workspace. This window exists for one reason and one reason only: a request filed under the wrong impression, or under duress, must be undoable. We chose 30 days because it is long enough to catch a request that was filed on a bad day and short enough to satisfy Article 17's "without undue delay" requirement.
Day 30 — Primary erasure
The workspace is erased from the primary store. Every note, every task, every calendar event, every attachment, every session log tied to the workspace address is removed. The workspace record is replaced by an anonymised tombstone that carries only the workspace UUID and the erasure timestamp — needed for audit-log integrity.
Day 30 to day 60 — Backup rotation
The point-in-time snapshots taken during your active period still exist in cold storage. They rotate out on their normal schedule (30 days for the hourly snapshots, 90 days for the Business cross-region snapshots). No process reads them; they are simply overwritten as new snapshots come in.
Day 30 — Certificate issued
A PDF certificate is generated, signed by our DPO with a long-lived Ed25519 key, and emailed to the workspace address (the email itself is delivered before the address is removed from the routing table). The certificate names the workspace UUID, the erasure timestamp and the anticipated backup rotation completion date.
What is retained
Invoices only, per §147 AO. The retained invoice contains your billing address and VAT identification, not any workspace content. The invoice is destroyed at the ten-year mark on its own automated schedule.
If you have questions about the erasure timeline, write to dpo@axoshub.org — our DPO office answers within two working days.