Export (§15.7) is for taking your data with you. Erasure is the opposite request: that BlossomERP permanently delete your company — every record, file and user account. It is deliberately a process, not a button, and it runs the same way whoever asks:
- Request. A company administrator asks from System Setup → Subscription ("Leaving BlossomERP? Request permanent erasure"), or the platform team opens the request. Nothing is deleted at this point.
- Verify. The platform's super-administrator verifies the request is genuine — an erasure is never executed on an unverified ask, and never by anyone but the super-administrator.
- Export. A full export of your company is built — every master and document the system can re-import, your attachment files, and statements for every customer and supplier — and offered to you. For a large company the build runs in the background, and the offer is recorded when the bundle is ready. The offer, and what you did with it (downloaded, declined, no answer), are recorded before anything else can happen. You can also take the export yourself from the Subscription page at any time during the process.
- Grace — 30 days, set by the platform. Your subscription is cancelled and the workspace becomes read-only, exactly as in §15.5. The length of this window is a platform setting — 30 days unless the platform sets otherwise — and the Subscription page names the exact deletion date that applies to you. Changed your mind? Stop this deletion is on the same page — the platform team is notified and the erasure ends.
- Purge and certificate. After the grace date, the super-administrator executes the purge by typing your company code. The system counts everything first, deletes in a fixed order, and then proves the result: an independent count must read zero — database, files, analysis warehouse, everywhere — before an erasure certificate is issued. The certificate records counts, dates and who acted; it never contains your data itself.
Three honest exceptions, stated before you ask rather than after:
- Platform billing records are kept for six years. The law requires the platform to keep its own invoices and receipts — what you were charged and what you paid. They are copied out of your company before the purge, kept in a closed register, and destroyed when the six years run out. The record of you in the platform's own books (your customer card there) is anonymised at the purge once nothing is owed: its name and contact details are scrubbed. What your bills and receipts say in their text (your company name, as printed at the time) is a posted document and is not rewritten — posted documents are never rewritten, for anyone.
- Backups age out, they are not edited. Live copies of your data disappear the moment the purge runs (the replica follows in seconds). Backup copies cannot be surgically edited; they expire on the backup schedule, so a backup taken before the purge may still contain your data for up to about six months after it. If a backup is ever restored, the erasure register is replayed first — an erased company is never resurrected by a restore.
- A legal hold, an unpaid platform balance, or a migration still running stops the process by name. The erasure waits, with the reason recorded, until the blocker clears.
Trials that never subscribe. A trial that never had an invoice — no money ever moved — follows the same ending automatically. When the trial ends the workspace goes read-only; you are notified at 7 days and again at 23 days, each time naming the exact deletion date (trial end + the platform's erasure grace — 30 days unless the platform sets otherwise) and the export and stop paths above. Subscribing at any point in that window cancels the deletion outright. The day a trial is invoiced — money in play — it leaves the automatic path entirely; a person reviews it instead.