Leaving
How to take it back
Every other page on this site explains what Beemy can do for you. This one explains how to pause it, shrink it, or delete it, and shows the proof you get for the last of those.
The short version
Five moves, from a temporary pause to a full account delete. Turning a category down or off needs no reason and no higher role. Nobody has to approve it. A delete works differently: you ask us, and a person on our side runs it.
On this page
Pause everything
You want Beemy to stop acting right now, everywhere, while you work out what you actually want.
Who can do it: Any team member. A kill switch is a safety-reducing move, so it never waits on a higher permission level.
Drops every category, in every connected silo, straight to read-only. Nothing wakes up again on its own.
killSwitch — backend/src/policy/grantService.ts, GrantService.killSwitch()
Beemy stops drafting and stops sending. It still reads, so nothing else breaks while you decide what to do next. Turning any category back on needs a fresh grant; nothing restarts by itself.
Turn one category down
You want Beemy to stop sending in one category, but you still want its drafts.
Who can do it: Any team member. Promoting a category needs a grant; lowering one never does.
Lowers one category to any rung below where it sits now. Stop at draft-only and the drafts keep coming.
demote — backend/src/policy/grantService.ts, GrantService.demote()
Beemy keeps drafting in that category, and every draft waits for you. Your other categories do not move.
Switch one category off
You want Beemy out of one category completely, back to reading only.
Who can do it: Any team member. A revoke needs no reason and no higher role, exactly like a demote.
Pins one category to read-only, the bottom rung. It is demote() with the level fixed, so it always lands on read-only.
revoke — backend/src/policy/grantService.ts, GrantService.revoke()
Beemy stops acting in that category and goes back to reading. Anything that needs an action there comes to you instead. Turning the category back on needs a fresh grant.
Delete one silo
You want your work data gone but you want to keep your personal inbox, or the other way round.
Who can do it: The silo's owner.
Runs four steps against one silo: purge the rows, destroy the key, verify both, then write a proof.
eraseSilo — backend/src/deletion/deletionService.ts, DeletionService.eraseSilo()
Hard-deletes every data-bearing row that belongs to the silo. Nothing is flagged; it is removed.
purgeSiloData — backend/src/db/gateway/gateway.ts, SiloGateway.purgeSiloData()
Destroys every version of the silo's own encryption key. This step cannot be undone.
cryptoShred — backend/src/crypto/siloKeyService.ts, SiloKeyService.cryptoShred()
The silo is the unit Beemy erases by. Delete your work silo and your personal one stays exactly as it was, connections and all.
Delete everything
You want your whole account gone: every silo, every connection, every draft.
Who can do it: You, on your own account.
Finds every silo you own and runs eraseSilo() against each one in turn.
eraseAccount — backend/src/deletion/deletionService.ts, DeletionService.eraseAccount()
Every silo you own is purged and key-shredded. What that leaves behind is covered honestly in the next section.
What survives
Three honest limits, stated plainly rather than left for you to find out.
The proof of your erasure survives your erasure
An erasure writes its own record to the audit trail. That record is built to outlive the data it describes. The trail itself, and the fact that a silo once existed and was erased, stay on file. Nothing readable from your inbox survives; the record that you asked, and that it worked, does.
audit_events foreign keys are set to onDelete: restrict, so an erasure can never cascade its own proof away.
There is no self-serve export today
You can ask us to hand your data back before you delete it, but there's no download button yet. Ask through the contact form, and a person on our side will sort it, not a script.
Checked directly: nothing under backend/src implements a portability, takeout or download feature.
Removing one account means erasing its silo
No separate disconnect exists today. A connection's token is encrypted under its own silo's key. Erasing that silo is what removes the account. If you want one account cut off and its history kept, we cannot do that yet.
Checked directly: nothing under backend/src disconnects a single connection. Each connection belongs to exactly one silo (backend/src/db/schema/connections.ts), and revoke() moves a policy category, never a connection.
The proof a full erasure leaves behind
Deleting a silo writes one erasure proof to the audit trail before it finishes. It holds every field below, so the erasure is provable from the trail alone, without trusting a support reply.
Which silo
The silo this erasure ran against.
ErasureProof.siloId
Row counts, per table
Every silo-scoped table, and its row count after the purge. Every one reads zero, or the erasure failed.
ErasureProof.tables
Key destroyed
Whether the silo's encryption key was confirmed unreadable after the shred, checked by trying to open it.
ErasureProof.keyDestroyed
The shred proof
The full ShredProof for this silo's key, carried inside the erasure proof.
ErasureProof.shredProof
Verified at
The moment the zero-row and key-destroyed checks both passed.
ErasureProof.verifiedAt
Key versions destroyed
Every version of the silo's key that existed, so an old backup key can't be missed.
ShredProof.keyVersions
Wrapped key fingerprints
A fingerprint of each destroyed key, so the proof can be checked without holding the key itself.
ShredProof.wrappedDekFingerprints
Key-encryption-key ids
The ids of the keys that wrapped the silo's own key, before that wrapping was destroyed.
ShredProof.kekIds
Destroyed at
The moment the key itself stopped existing.
ShredProof.destroyedAt
Read next
Get your time back.
Beemy is in private beta. Join the waitlist and go from connect to a quiet, triaged inbox before you close your laptop tonight.
You're in the hive. We'll buzz you when it's your turn.
While you waitLast updated