You own your data. This page explains how to take it with you before you leave, how to close the organisation, and how a single person leaves or deletes their account. Plan the steps in this order: export, check, release licensed devices, then delete.
1. Export the organisation’s data
An Owner can download a full export of the organisation as one JSON file. It is an API call made from a signed-in owner’s session (API keys never hold owner-only permissions):
POST /tenant/{tenantId}/api/exportThe answer is a file download named tenant-export-<tenantId>-<YYYY-MM-DD>.json, with an exportedAt time stamp.
| Included | Notes |
|---|---|
| Devices and their attributes | At most 10,000 rows each. Firmware and connection-state columns; values under secret-looking keys are masked. |
| Dashboards | Board definitions. |
| Members and their roles | |
| Domains | With their verification status. |
| API keys | Names, permissions and dates; never the key itself. |
| Webhooks and their deliveries | Never the signing secret. |
| Settings | The organisation’s setting rows. |
| Usage counters, notification log, stored file list, camera recording index | |
| AI firewall incidents | |
| SAML configuration | Never the private key. |
| Audit log | The newest 1,000 rows by default. |
Never included: device credentials, tokens, passwords, certificate private keys and device IP addresses.
Data Export settings (Settings > Data Export):
| Setting | Default | Range |
|---|---|---|
| Audit log rows in an export | 1,000 | 1 to 100,000 |
| Minutes between exports | 60 | 60 to 1,440 |
One export may run per window; every export request is written to the audit log (tenant_export.requested).
2. Export what the organisation export does not hold
The JSON export is a portability snapshot, not a full backup. Take these separately:
| Data | How |
|---|---|
| Telemetry history | The history API or a card’s download. See Exporting data and History API. |
| Full audit log | Export CSV on the audit log, or the export API with a date range. See Audit log. |
| Board files | Download each board as a file. See Templates and board files. |
| Device profiles, flows, alarm and rules cards | Read them with the API, or note their settings. They are not part of the export file. |
3. Release licensed devices
Licensed devices you claimed stay bound to your organisation. Release each one on its Ownership tab, so that a new owner can claim it. See Adding and claiming devices.
4. Schedule the deletion
- Open Settings. At the bottom, under Danger Zone, find Delete Organization: “Schedules the organization for deletion. After a 30-day grace period, all of its data, including members, settings, subscription history and files, is permanently deleted. The owners are notified, and the deletion can be cancelled until then.”
- Type
DELETEto confirm and select Schedule Organization Deletion. - The page says “Deletion scheduled. The organization will be permanently deleted after date. Its owners have been notified.”
Until that date the organisation is read-only and Cancel deletion restores it (“Deletion cancelled. The organization stays active.”). Only an owner can schedule or cancel: “Only an owner of this organization can delete it or cancel its deletion.” A deletion scheduled by Hermetry can only be cancelled by Hermetry.
After the grace period everything is purged and cannot be recovered. Cancel a paid plan separately if you do not want it to renew; see Payment and plan changes.
Leaving as a person
A member who leaves the organisation is removed by an administrator on Members (Remove). Their account stays and can still be a member of other organisations. API keys they created stop working, unless a key was marked Service key (“Yes: survives its creator”).
Export your own data
Any member can request a copy of their own data held by the organisation, plus their account record. The request asks for your password again:
POST /tenant/{tenantId}/api/auth/me/data-export-request
Content-Type: application/json
{ "password": "…" }The answer holds a short-lived link to the file.
Delete your account
Deleting your account removes it from every organisation at once. It asks for your password again (an account created by social sign-in needs none):
POST /tenant/{tenantId}/api/auth/me/deletion-request
Content-Type: application/json
{ "password": "…" }If you are the only owner of an organisation that still has other members, the request is refused with 409: hand over ownership first; see Users and roles. An organisation where you are the only member is scheduled for deletion with your account. A screen for these requests on My Profile is In development.
What is kept after an erasure, and why, is in Privacy and data erasure.