Data requests

When someone asks what you hold about them, or asks you to delete it, you need to answer fast and be able to show you did. Data requests do both for the data the sign-in service keeps. There are two kinds:

Request	What it does	Reversible?
Export	Gathers what is held about the person into one JSON file	n/a, nothing changes
Erase	Deletes the account and clears what could identify the person	No

What is covered

Data	Export	Erase
Profile: email, name, picture, phone, public and private metadata	Included	Account deleted; name, picture, phone and metadata cleared; the address is replaced so it can be used again
Linked accounts (social and company sign-in)	Included	Removed
Sessions and devices	Included	Sessions ended; devices removed
Passkeys, second factors, personal API keys	Listed by name (never the secrets)	Removed
Organization memberships	Included	Removed
Sign-in history	Included	Kept as counts, but the person, email address, IP and device are cleared
Requests they made with their token	Included (the latest 5,000 are listed; the total is counted)	Kept as counts, but the person, IP and device are cleared
Password hashes, key values, factor secrets	Never included	Removed

Rows in your own tables (an order, a review, a message) are not covered. Your application owns them. Export or delete them yourself, using the person’s id, before you erase the person.

In Studio

Users & auth → Records → Data requests lists every request handled in the environment: when, whether it was an export or an erasure, the person’s id, and what was found or removed. To make a request, open the person (Users & auth → Users), go to Security, and find Data requests:

Export their data downloads the JSON file.
Erase their data… asks you to type their email address. The button stays off until it matches exactly, so the wrong person can’t be erased by a misclick.

The record

Every request leaves a record so you can show it was handled. The record holds no personal data: the person’s id, a one-way hash of the email address they had, who asked, and counts. An erasure record says “2 sessions, 1 device and 14 sign-in records were cleared”, not who the person was. Exports themselves are not stored. They are returned once, to you.

From your code

import { createClient } from "@pawabase/client";
import { admin } from "@pawabase/client/admin";

const a = admin(createClient({ url, apiKey: "pb_sk_…", environment: "production" }));

const { data, request } = await a.users.exportData(userId);   // data is the JSON to hand over
await a.users.eraseData(userId, "ada@example.com");           // final: confirm with their email address
const handled = await a.privacy.requests({ limit: 20 });

from pawabase import Pawabase

pb = Pawabase(url, "pb_sk_…", environment="production")

answer = pb.admin.users.export_data(user_id)                   # answer["data"] is the JSON to hand over
pb.admin.users.erase_data(user_id, confirm="ada@example.com")  # final: confirm with their email address
handled = pb.admin.privacy.requests(limit=20)

All three need a secret key. An erasure fails with 400 if confirm is not the person’s email address (not case-sensitive).

A good routine

Check who is asking. A request that arrives by email should come from the address on the account.
Export and send the file to the person.
For an erasure, delete the person’s rows in your own tables first, then erase the account.
Keep the record. It is your proof, and it is safe to keep.

Events

user.data_exported and user.erased are emitted for each request. See Auth webhooks.

Users

Open a person and manage their account.

Sign-in activity

The log that erasure clears the personal parts of.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

What is covered

In Studio

The record

From your code

A good routine

Events

Users

Sign-in activity

​What is covered

​In Studio

​The record

​From your code

​A good routine

​Events

Users

Sign-in activity

What is covered

In Studio

The record

From your code

A good routine

Events