# Leaving

> Export, deletion, and what remains.

Your content was never in LightHouse, so leaving is mostly about the telemetry LightHouse holds for you, and the engine in your account, which is yours to keep or remove.

## Export

You can export everything LightHouse holds for your tenant at any time, without leaving.

**What you get.** Every row of your tenant, one JSON Lines file per table, and a `manifest.json` listing each file with its SHA-256, so you can prove the copy is complete and unaltered. It is the same format offboarding uses.

**How.** A `client_admin`, signed in as a person: **Setup and admin → Data export**, or the API.

**curl**

```bash
# Start an export (one runs at a time per tenant)
curl -X POST "https://$AAL_TENANT.atlanticagenticlabs.com/api/v1/exports" \
  -H "Cookie: CF_Authorization=$CF_AUTHORIZATION"

# When it is ready, ask for it by id: `links` maps each file to a link,
# each valid for 15 minutes and made afresh on every request
curl "https://$AAL_TENANT.atlanticagenticlabs.com/api/v1/exports/$EXPORT_ID" \
  -H "Cookie: CF_Authorization=$CF_AUTHORIZATION"
```

**Python**

```python
import os
import time

import httpx

base = f"https://{os.environ['AAL_TENANT']}.atlanticagenticlabs.com/api/v1"
cookies = {"CF_Authorization": os.environ["CF_AUTHORIZATION"]}

export = httpx.post(f"{base}/exports", cookies=cookies).json()["export"]
while True:
    one = httpx.get(f"{base}/exports/{export['id']}", cookies=cookies).json()
    if one.get("links"):
        break
    time.sleep(10)
for name, url in one["links"].items():
    print(name, url)
```

**TypeScript**

```ts
const base = `https://${process.env.AAL_TENANT}.atlanticagenticlabs.com/api/v1`;
const headers = { Cookie: `CF_Authorization=${process.env.CF_AUTHORIZATION}` };

const { export: started } = await (await fetch(`${base}/exports`, { method: "POST", headers })).json();
let one;
do {
  await new Promise((r) => setTimeout(r, 10_000));
  one = await (await fetch(`${base}/exports/${started.id}`, { headers })).json();
} while (!one.links);
console.log(one.links);
```

Starting an export, and every request for its links, is written to your audit log. A second export while one is running answers `409 conflict`. See the [Exports reference](/api/reference/exports/).

## Deletion

When you leave, Atlantic offboards your tenant, in this order, each step recorded so that an interrupted run resumes where it stopped:

1. **Suspend.** Your tenant stops accepting sign-ins and reads. Your deployments’ keys and your API keys are revoked, so nothing new arrives.
2. **Export.** Every row is exported in the format above, and the export is verified against its manifest before anything is deleted.
3. **Sign-in removed.** Your tenant’s Cloudflare Access application, its identity providers, policies and service token are deleted.
4. **Rows deleted.** Your tenant’s rows are deleted from every table and partition.
5. **Key destroyed.** Your tenant’s own encryption key is scheduled for deletion, with the 30-day waiting period AWS KMS requires. Once it is gone, your report documents and any exported content are unrecoverable everywhere, backups included.
6. **Delivered secrets removed.** Anything delivered for your tenant is scheduled for deletion.

Your engine is in your account. Remove it with your own pipeline, as you applied it; LightHouse never had the access to do either.

## What remains, and for how long

| What                                                                                                     | How long                                                                       |
| -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
| LightHouse’s database backups, which contain your operational telemetry until they age out               | Up to 14 days after deletion                                                   |
| Your report documents and exported content in those backups                                              | Unreadable once your tenant’s key is destroyed (30 days after it is scheduled) |
| Atlantic’s own record that your tenant was offboarded: when, by whom, and the export’s manifest checksum | Kept, as Atlantic’s record of having done it                                   |
| Invoices issued to you                                                                                   | Kept by Atlantic and its payment processor, Stripe, as accounting records      |
| Everything in your account                                                                               | Yours. Nothing of it was in LightHouse                                         |

## A person’s data, without leaving

To remove one person’s data, for example on an erasure request, Atlantic finds and erases their rows by the keyed hash your deployment computed for them. LightHouse never receives the identity itself. Ask through your certified forward-deployed engineer.

Source: https://docs.atlanticagenticlabs.com/data-sovereignty/leaving/