What happens to company data after an employee leaves
A single “delete employee” action is not enough. Companies need distinct modes with distinct consequences.
Access closes first
The membership is blocked, sessions are revoked, and WebSocket connections close. This should happen as one consistent server-side operation.
A wipe command is created for a lost or managed device. The official client applies it before opening local cache on its next validated launch.
Profiles and messages follow different policy
A company may need to retain history while removing personal fields. In other cases, an owner chooses to purge an author's content and dependent files.
Shared conversations need explicit policy so deleting one author does not accidentally destroy other participants' data.
Permanent purge needs evidence
A worker removes records and objects, clears cache, destroys applicable wrapping keys, and retains a minimal deletion receipt.
The system reports which official clients acknowledged wipe. Missing acknowledgment never becomes a false promise that an external copy disappeared.
This guide explains verifiable product principles and is not legal advice.