How to delete your FusionAuth account

About deleting your FusionAuth account

FusionAuth is an identity and access management (IAM) platform designed for developers who need robust authentication, authorization, and user management services. Unlike SaaS-only platforms, FusionAuth is often self-hosted, meaning that while you have control over your infrastructure, the responsibility for data governance lies heavily with your implementation team.

Users typically decide to delete their FusionAuth account or terminate their instances for several specific reasons:

• Transitioning to a different IAM provider or an in-house authentication solution.
• Migrating from a cloud-based instance to a self-managed environment (or vice-versa).
• Security audits requiring the complete purge of identity databases to meet compliance standards like SOC2 or GDPR.
• Simplifying your architecture by removing unused multi-tenant instances or orphaned applications.

What happens to your data

When you request account closure, FusionAuth manages the removal of your subscription data, but you must ensure your underlying databases are purged to maintain privacy. FusionAuth collects specific sensitive information, including:

• Identity attributes (email addresses, phone numbers, and custom user data fields).
• Authentication logs and login timestamps.
• Security metadata including cryptographic keys, API keys, and password hashes.
• Integration settings for OAuth2, OIDC, and SAML configurations.

While the FusionAuth service may delete your billing profile and administrative access, you must ensure that your local database instances (PostgreSQL or MySQL) are properly wiped, as FusionAuth acts as a controller over these databases in many deployment models. Without performing a manual database drop, remnants of your user base may persist.

Privacy considerations

Using FusionAuth involves significant data security responsibilities. Because it manages user identity, it is a high-value target for data breaches. To maximize privacy, ensure that:

• You rotate all database credentials before account deletion.
• You delete individual user accounts via the API before closing the master account to ensure row-level deletion.
• You clear logs that may contain personally identifiable information (PII) residing in application headers or system logs.
• You remove any webhooks or third-party integrations that were receiving user-event streams during the lifecycle of your FusionAuth instance.

Frequently Asked Questions

Does deleting my FusionAuth cloud account automatically wipe my database?

No. If you are using the self-hosted version, FusionAuth only deletes the administrative account associated with the service, not the underlying database you own. You must manually drop your database tables.

Can I recover my data after requesting account closure?

Once the support team processes a formal deletion request for a cloud instance, backups are purged according to their retention policy, making data recovery effectively impossible.

How do I remove users before closing my account?

It is recommended to use the FusionAuth User API to perform a batch delete of all user objects before initiating the account closure request to ensure no residual data remains.

Does FusionAuth track my users for advertising purposes?

No, FusionAuth is an infrastructure-as-code identity provider; it does not utilize tracking pixels or share user data with third-party advertisers.

Do I need to delete API keys before closing my account?

Yes, for security hygiene, you should revoke and delete all generated API keys and client secrets in the 'API Keys' section of the dashboard before finalizing your departure.

What happens to my OIDC configurations after deletion?

Your OIDC configurations, including client secrets and discovery endpoints, will be deleted from the FusionAuth server, effectively revoking access for all integrated applications.