Skip to main content

Decommission and data removal

Customer- and operator-facing procedure when a Roasthubs edge installation is decommissioned (end of contract, site closed, or hardware returned) or returned to a clean state for reuse. This supports CRA Annex I Part I §13 (secure removal of data and settings).

Operational runbook for Roasthubs staff: rhsos-infra/docs/factory-reset-and-decommission.md.

What happens to your data​

Read this before you request decommission.

Data classWhat we do
Sensitive dataRemoved from the edge product and from site-specific access paths we control for that installation. That includes credentials and secrets on the host, customer-identifiable operational content on the edge database and volumes, TLS/tunnel material for the site, and site-specific cloud access keys used by that IPC.
Anonymised dataMay be retained where your contract (or data-processing / service agreement) already allows it — for example aggregated or anonymised usage, quality, or support metrics that can no longer identify your organisation, sites, or people. Retention follows that agreement, not this page.
Backups you asked forIf you need an export of customer data before wipe, request it before decommission starts. Exports are handled under your data-processing agreement.

If your contract says something different about anonymised retention, the contract wins. Contact Roasthubs if you need the exact clause confirmed for your account.

When to use this procedure​

  • End of contract or offboarding of a site
  • Hardware leave of service (return, dispose, or move out of Roasthubs support)
  • Factory-style reset so the same IPC can be reused for another tenant or a clean reinstall

Roasthubs operations perform the technical wipe and access revocations. You confirm scope and any export needs.

Procedure​

1. Confirm scope with Roasthubs​

Tell us which of these you need:

  1. Decommission — site leaves service; remote trust and site secrets are revoked; edge data wiped as below.
  2. Factory reset for reuse — same wipe and revokes, then a fresh install for a new or same customer with new secrets and remote access (nothing from the previous tenant is reused).

Also confirm:

  • Site / hostname (or other identifier we already use with you)
  • Whether you need a data export before wipe
  • Preferred maintenance window
  • Whether hardware stays on site, is returned, or is disposed of under your policy

2. Optional: export before wipe​

If you need a copy of customer data from the edge or agreed backups:

  1. Request the export in writing (email to your usual Roasthubs contact, or info@roasthubs.com).
  2. Wait until we confirm the export is delivered under your agreement.
  3. Only then schedule the wipe.

3. Decommission window (Roasthubs operations)​

During the agreed window we:

  1. Stop the application stack on the edge host.
  2. Disconnect remote access agents for that host (Cloudflare tunnel; ZeroTier only if that site still uses it).
  3. Remove sensitive material on the host (application secrets, cloud credentials, site TLS material, local database and Docker volumes used by the stack, local logs/metrics stores as applicable).
  4. Revoke site-specific cloud and network trust (tunnel/DNS, IAM/ECR keys for that host, inventory and monitoring entries for that site).
  5. For reuse: reimage or re-run setup with fresh secrets for the next tenant.
    For end of life: complete revokes; cryptographic erase or physical handling follows your hardware policy and our ops runbook.

You do not need to run host wipe commands yourself unless we explicitly ask you to (for example local network access only you control).

4. Confirmation​

After completion we confirm:

  • Sensitive edge data and site secrets for that installation were removed
  • Remote access for that host was revoked
  • Whether any anonymised datasets remain under your contract (we do not keep identifiable site content on the decommissioned edge stack)

Keep that confirmation with your offboarding records.

Customer checklist​

  • Scope agreed (decommission vs factory reset / reuse)
  • Export requested and received (if required)
  • Maintenance window agreed
  • Hardware fate agreed (stay / return / dispose)
  • Written confirmation received after wipe