Data Deletion And Disconnect

Users can revoke legacy localhost MCP access tokens from the Console token manager. Public remote MCP access is controlled through WorkOS authentication and the tenant beta admission policy.

Google Ads access can be disconnected from the Console by calling POST /api/v1/google/auth/disconnect. This marks Google Ads connections as disconnected, deletes stored OAuth tokens, clears cached customers, and writes redacted audit evidence.

Tenant-scoped Google Ads data deletion is available through POST /api/v1/privacy/delete-data with explicit confirmation. It removes OAuth connections, MCP tokens, tool invocation logs, jobs, logs, launch plans, approval requests, proof snapshots, Merchant readiness snapshots, operation policies, and OAuth verification package records.

The system keeps a minimal deletion receipt containing a fixed non-secret reason code, aggregate deletion counts, and timestamp. Tenant identity, membership, and beta-admission records are retained so the service can enforce account closure, access revocation, and compliance obligations. Reports may retain redacted operational evidence only when required for security or compliance review.