Account & Data Controls
Account & Data Controls
Effective date: July 2, 2026. This page describes Monocrat v1 account cancellation, source disconnect, data access/export, deletion, retention, and Trust Graph disposition rules.
1. Owner-Only Account Authority
Monocrat v1 launches with one verified owner-operator account per tenant. Cancellation, account deletion, source disconnect, billing finalization, Trust Graph consent decisions, and data access/export requests are owner-only unless a support/legal request, provider privacy webhook, or written agreement creates a different legally valid route.
2. Non-Billable Control Plane
Cancellation, source disconnect, billing support, data access/export, legal erasure, deletion preview, deletion completion notice, security alerts, and support/legal status are non-billable control-plane actions. They remain available when usage credits are depleted.
3. Cancellation
The verified owner may request cancellation through Billing & Usage, settings, Stripe Customer Portal if available, or support. Cancellation stops future subscription renewal according to the cancellation flow shown at the time of cancellation. Final invoices, pending direct charges, refunds, credits, disputes, and retention exceptions may remain open after cancellation.
Included monthly credits, bootstrap allowance, operator credits, refund credits, and dispute credits are not cash balances and are not converted into cash, stored value, or transferable credits at cancellation.
4. Account Deletion Requests
During private beta, account deletion and legal erasure are handled as owner-verified support/legal requests. The product may show request status, previews, retained categories, and completion evidence, but deletion execution is performed through an operator runbook after owner verification, scope review, billing finalization, and retention checks.
| Step | Owner-visible behavior | System action |
|---|---|---|
| Request | The owner requests cancellation, account deletion, legal access/export, legal erasure, or source disconnect from settings, Billing & Usage, or support/legal intake. | Monocrat records the request type, owner/session evidence, support or legal case refs if any, and subject scope for operator review. |
| Review | Monocrat confirms owner authority, affected subject scope, irreversible effects, billing status, connected sources, Trust Graph disposition, and retained categories before execution. | New paid/background work may be frozen while non-billable support, billing, security, and deletion-request handling remain available. |
| Service shutdown planning | Monocrat explains which capabilities stop immediately and which remain available for billing, support, security, legal, or audit reasons. | Operator runbooks revoke sessions where required, stop tenant-paid schedulers, close non-required pending actions, and preserve incident/security channels. |
| Source disconnect | Monocrat shows connected sources, disconnect status, provider-owned controls, and any source-side handoff instructions. | Operator runbooks revoke, remove, deauthorize, invalidate, or disable provider/source credentials where supported, or record a provider-owned handoff/fallback. |
| Billing finalization | Monocrat surfaces final invoice, direct-charge, credit, refund, and dispute status. | Billing runbooks cancel or schedule cancellation in Stripe billing, reconcile pending direct charges, and record invoice/receipt/dispute refs when required. |
| Deletion execution | Monocrat states the 30-day live-serving deletion rule and retained exception categories. | Operator runbooks delete in-scope tenant-private Monocrat data from live serving systems within 30 days, subject to retention exceptions. |
| Completion evidence | Monocrat sends or posts completion evidence and retained-category information. | Monocrat records deletion audit evidence and support/legal contact paths. |
5. 30-Day Live-Serving Deletion Rule
Confirmed account deletion, legally valid erasure requests, and supported provider privacy redaction requests delete in-scope tenant-private Monocrat data from live serving systems within 30 days. Live serving systems include tenant graph state, tenant workflow tables, sessions/cache, tenant artifacts, vector index entries, dashboard/search indexes, source-connector credential envelopes, and pending queue payload stores still within product retention.
Deletion does not silently promise immediate deletion from backups, security logs, payment/tax/dispute records, fraud/abuse records, legal holds, provider logs, provider batch results, processor records, or third-party provider systems. Those categories are retained only for applicable legal, security, accounting, tax, payment-network, provider-contract, dispute, incident, or backup purposes.
6. Retained Categories
| Category | Purpose | Access boundary |
|---|---|---|
| Backups | Disaster recovery and corruption rollback. | Restore-only; no normal product reads. |
| Security logs | Abuse, intrusion, fraud, and tenant-isolation investigation. | Security and on-call need-to-know. |
| Incident and erasure audit | Prove deletion/erasure actions and operator actions. | Legal, security, and audit reviewers. |
| Stripe/payment/tax records | Invoices, refunds, disputes, chargebacks, taxes, receipts, and accounting. | Finance, legal, and support need-to-know. |
| Fraud/abuse records | Prevent re-enrollment abuse and defend disputes. | Security and legal need-to-know. |
| Provider and processor records | Provider-side logs, OAuth removal records, LLM batch results, deletion evidence, and processor records retained under provider terms. | Provider-side controls plus Monocrat vendor/legal review. |
7. Data Access And Export
Monocrat v1 does not provide arbitrary bulk self-serve export. Immediate control-plane downloads may include invoices, receipts, usage summaries, current rate-card snapshot, account/settings summary, integration/source inventory, notification preferences, feature configuration summary, support case list/status, published Trust Graph claim manifest, and deletion/retention preview manifest.
Broader access/export packages require owner request or legal/support intake, scope preview, fresh reauthentication where owner-initiated, support/legal review, redaction, encrypted tenant-scoped package handling, package hash, manifest hash, short-lived authenticated download, expiry, and audit. Packages are not emailed as attachments.
8. Never Exported Categories
Monocrat does not include secrets, OAuth refresh tokens, payment instrument tokens, private keys, provider credentials, internal provider COGS, route/margin decisions, system/developer prompts, security detection internals, cross-tenant data, another tenant's data, another counterparty's private data outside a legally reviewed scope, or raw private content without explicit review and redaction in self-serve or reviewed owner packages.
9. Source-Provider Handoff
Some records remain controlled by the source provider, such as Google, Stripe, Plaid, Square, Shopify, Moov, or another connected service. Monocrat may show provider status, links, or handoff instructions, but provider-owned exports and provider-side deletion are governed by the provider's controls and terms. Connected-source handling is described in the Connected Sources Policy. Payment rail workflows are also governed by the Payment Rail Terms.
10. Trust Graph Disposition
Published Trust Graph content carries provenance before publication. Public-derived claims may persist independently of the Monocrat account when the underlying public source, source policy, provenance, freshness, correction/takedown, safety, privacy, and legal review still support publication. Tenant-private-source-derived, Monocrat-generated, tenant-action-derived, tenant-consent-derived, and tenant-bound counterparty-consent-derived claims are deleted, revoked, or unpublished with explicit disposition evidence.
Public claim publication, correction, takedown, revocation, and counterparty consent handling are described in the Trust Graph Publication Policy.
11. Contact
Data access, deletion, erasure, export, or retention questions can be sent to privacy@monocrat.ai. Billing cancellation or invoice questions can be sent to billing@monocrat.ai. Support and recovery handling is described in the Support & Admin Access Policy.