Closing your account & deleting your data

Closing your account permanently deletes your company’s cap table and everything tied to it - the ledger, every document and signature, every valuation, board approval and tax record. It can’t be undone. So closing is a handoff: before anything is erased, you take a complete copy and tell us you have it.

How closing works

As a workspace admin, open Accounts → Account, scroll to Danger zone, and click Close this account & delete all data. Three steps follow, one after another. The erase runs as soon as you confirm the last one, and you are signed out when it is done. A workspace that never created a company has nothing to archive, so it goes straight to step 3.

Prefer a person to handle it? Email security@tenacap.com from the email on your admin account and we’ll verify you own the account and run the closure within 30 days of a verified request, usually sooner. Steps 1 and 2 are still yours to do: only you can download the archive and affirm that you hold it.

Step 1: the complete archive

Click Build the archive. The page shows its progress, then the size and SHA-256 of the complete archive: one zip holding every record and every document Tenacap has for your company - the cap table in our open schema, board approvals, 409As, tax records, signature requests and their signer evidence, sealed signature PDFs, uploaded and attached documents, the export you originally imported from. It carries a manifest that fingerprints each file and a coverage report that says what the database held next to what was written. See Export & open schema for what is in it and what each status means.

The summary on the page lists, individually, anything that is not a copy of bytes we held: a 409A that was a link to a file hosted elsewhere (NOT_IN_CUSTODY - fetch it from there), a signature request that never reached a sealed PDF (NOT_SEALED).

Download and verify saves the file, then your browser computes the SHA-256 of the bytes it received and compares it to the SHA-256 we took of the stored zip. If a proxy truncated the download, or two downloads interleaved, the digests differ, the page says so, and you cannot go on. A matching digest is the evidence that you hold the archive.

Step 2: affirm you hold it

You tick a statement that says what was checked - the file you received matches the one we stored, you have read the statuses above, and you hold this copy - and, if the summary listed anything not included as bytes, you acknowledge those by count. Then you choose what happens to our copy (below) and click Affirm. The affirmation posts your digest back to us; we compare it once more to the stored archive and refuse if it doesn’t match, if the coverage report is short of the database, or if your company changed after the archive was built (a SAFE signed after Tuesday’s archive isn’t in Tuesday’s archive - build a fresh one).

We record the affirmation as a receipt: the archive’s id, digest and size, its full manifest and coverage report, the statement you ticked, who affirmed it and when, and your retention choice. The receipt is written to survive the closure it records, and a copy is emailed to you before anything is deleted. Keep it with the zip - the digest is how anyone, later, can check that the file you hold is the one you affirmed.

Step 3: close

Type DELETE and click Permanently close & delete. The button stays disabled until the affirmation exists. Changed your mind after affirming? Start over with a fresh archive lets you build and affirm a new one. If anything about the closure fails partway, nothing is deleted, the receipt says so, and you’ll see a message.

What happens to our copy

The archive you downloaded is also stored on our side until you close. At step 2 you choose one of two things for it:

• Delete everything now. When the account closes, we delete our copy of the archive along with everything else. The only copy in existence is yours. This is the default.
• Hold a seven-year archive. We keep that exact file - and nothing else - for seven years from your affirmation, then delete it. To retrieve it, email security@tenacap.com from the address on the receipt. The file we hold is byte-for-byte the one you affirmed, so its SHA-256 is on your receipt.

Either way, the receipt itself is kept: it is the record that a handoff happened, what it contained, and what you chose.

What we erase

When we close your account, we permanently delete:

• Your cap table - every share class, stakeholder, security, option pool, SAFE/note, and the full transaction ledger.
• Your documents and signatures - signature requests and their evidence, sealed PDFs, uploaded and attached documents - and your valuations, board approvals, and tax records held in the app.
• Your uploaded import files and prior cap-table versions.
• Your workspace, its members, pending invites, and any agent tokens.
• Your login - the account itself, sign-in sessions, and any connected Google sign-in - for anyone whose only workspace was yours.
• Your entry on our waitlist, if one remained.
• Our copy of the complete archive, unless you asked us to hold it.

What we keep, and why

Two things:

• The handoff receipt described above - your company’s name and id, the archive’s digest, manifest and coverage report, the statement you affirmed, the email address and time of the affirmation, and your retention choice. It proves the handoff happened and what it contained; it does not contain the cap table, the documents or anyone’s personal data beyond the affirming admin’s email.
• Our internal security audit log, which records that actions occurred: sign-ins, closures, the archive being built and the handoff being affirmed. Entries carry an account identifier, a timestamp and - for account-lifecycle events like closure - the admin’s email address, so that a closure can be traced to the person who requested it. No cap-table figures, tax IDs or documents. The log is hash-chained.

If you chose the seven-year hold, add the archive itself to that list for seven years. We do not keep your cap table, documents, or personal profile data beyond the deletion above.

Legal holds

If we receive a subpoena, a litigation hold or a regulator’s preservation request that names your company, we place a hold on the account. While a hold is open, closure is refused - for you and for us alike - and a held archive copy is not deleted when its clock runs out. A hold is placed and released only by a named person on our side, each with a written reason in the audit log. If a close is refused for this reason, the page says so.

Backups

Once deleted, your data is gone from the live system immediately. Encrypted, access-controlled database backups exist for disaster recovery and are cycled out on a rolling basis; any residual copy of your data ages out of them within about 30 days.

On someone else’s cap table?

If you’re an employee or investor who appears on a company’s cap table (rather than owning the account), that company controls those records. Ask them to update or remove your information, or email security@tenacap.com and we’ll route your request to the right place. For more on how we protect data while it’s with us, see Trust & security.