Deleting a Client

Archive a former client to keep its records read-only, or have an admin delete an archived client permanently, with a backup first.

There are two ways to end an engagement in Bedrock GRC, and they are very different:

	Archive client	Delete permanently
What happens	The client is closed: read-only for staff, gone for assessors, its portal links revoked.	The client and everything it holds are erased.
Records and files	All kept.	All deleted, issued assessments included.
Undo	Restore client brings it back.	Cannot be undone.
Who	Anyone with edit access to the client.	Admins only, and only on an archived client.

Archive first. Delete permanently only when a contract or an erasure request requires the client to be gone.

Archive a client

At the bottom of the client's Profile tab, under Archive this client, choose Archive client and confirm. The client:

leaves the portfolio, the client list, Monitoring and search;
stays readable to the staff who are on it, under Clients → Archived clients, marked Archived · read-only. Every change is refused, admins' included, except Restore client and an admin's permanent deletion;
disappears for assessors from partner firms;
has its client access links revoked, each recorded in the audit log. Clients archived before this rule existed had their live links revoked when it was installed.

Exports and, for people with edit access, the full backup can still be downloaded from an archived client. See Clients and the Portfolio.

Only an admin can do this, and only once the client is archived.

Open the archived client's Profile. At the bottom, the Delete permanently card lists what will be deleted.
Download a full backup first if the client's records should be kept anywhere, such as for the client or for your own records. See Client Backup and Restore. Keep the backup encrypted: its files are not.
Type the client's name exactly as shown to confirm.
Choose Delete permanently and confirm once more.

You return to the archive list with a message saying the client was deleted.

Everything that belongs to the client, in one step that either completes or changes nothing:

the profile, contacts and the people assigned to it;
goals, risk appetite and risks;
adopted frameworks, answers, objective answers and snapshots;
issued assessments from partner firms, which otherwise can never be deleted;
the roadmap;
documents, evidence, engagement agreements, every version and every stored file;
vendors, assets, calendar events and the engagement log;
client access links and any open portal sessions;
imports still waiting for review.

Nothing that belongs to another client is touched.

The audit log. The client's earlier entries stay, without the link to the client, and one more entry (client.purge) records who deleted client id and when. See Audit Log.
Backups you downloaded, wherever you put them.
Database backups taken by whoever runs the service, until they age out of their retention period. On the hosted service, ask support@foxxcyber.com about retention if an erasure request needs a date.

An archived client comes back with Restore client on its profile, with its records as they were. Its client access links do not come back, because archiving revoked them; make new ones as needed.
A deleted client can only come back from a client backup, which an admin restores as a new client from Clients → New client.