Skip to content
NovaVMS Manual

Archive an unpaid org after billing grace

Use this procedure after billing grace has expired for a customer and finance has signed off on suspension. The flow is a two-stage timer: disable immediately (US-PLAT-5), then hard-delete after 90 days if the customer does not pay and reactivate. The 90-day retention window matches D79’s 7-day org-delete grace extended for paused-but-reversible billing cases — the longer window exists specifically so a late-paying customer can return without data loss.

Procedure

  1. Open the finance ticket. Confirm the grace_expired_at timestamp and the notification email to the Owner. Do not proceed without both.

  2. Call POST /api/v1/platform/orgs/{org_id}/disable with reason = "billing_grace_expired ticket=<id>".

  1. Verify the org’s status is now disabled and every active session in that org has been revoked (session_evicted WebSocket message). Gateway WS connections from that org close within a few seconds (cloud/internal/platform/org_service.go:159).

  2. Set a follow-up for 90 days from today with the org ID, the ticket number, and the expected purge date.

  3. Between day 1 and day 90 the org remains disabled but recoverable. If finance marks the account paid, call POST /api/v1/platform/orgs/{org_id}/enable (org_service.go:177) and close the ticket. No audit cleanup is required — the org.disabled_by_platform / org.enabled_by_platform pair stays in both audit logs forever.

  1. On day 90, if the org is still disabled and finance has not reopened the ticket, initiate platform-tier hard-delete: POST /api/v1/platform/orgs/{org_id}/delete with body {"confirm_name": "<exact org name>"} (cloud/internal/platform/org_handler.go:32,135-138). This flips organizations.status to pending_deletion and writes platform.org_delete_scheduled to platform_audit_log (org_service.go:221). It also cascade-revokes every active impersonation token targeting the org so no platform admin retains a live support session into a tenant marked for deletion. Note: the post-grace background hard-delete sweeper is not yet shipped (GAP-9-10), so the org will sit in pending_deletion until an operator runs the purge manually.

Common variations

  • Customer pays partway through the 90 days: enable the org. All users can log in immediately. Data is intact.
  • Customer asks for their data before purge: route the request via Per-customer data export while the org is still in disabled state. The export tooling works on disabled orgs.
  • Finance asks to skip the 90-day window: refuse unless the request is in writing from the VP of Finance. The 90 days exist to protect Novalien from bad-faith deletion disputes, not as a courtesy.