[DEPR]: User Retirement Records Redaction #37921
Description
RFC Start Date
N/A -- Already Accepted
Target Plan Accepted Date
N/A -- Already Accepted
Target Transition Unblocked Date
Immediately -- Transition Already Unblocked
Earliest Breaking Changes Unblocked Date
2026-02-01
Rationale
User retirement records are currently hard-deleted from the database. This causes:
- Fivetran detects deletions and creates soft delete entries in Snowflake with visible PII
- Retirement audit trail is lost when records are deleted
Solution: Replace hard delete with in-place PII redaction. Records persist with redacted values instead of being deleted.
Description
This change modifies the user retirement cleanup process to redact PII fields (username, email, name) values instead of hard-deleting records. This prevents Fivetran from creating soft-deleted records with visible PII in Snowflake. The implementation adds three PII parameters (redacted_username, redacted_email, redacted_name) to the LMS cleanup endpoint, tubular scripts, and Jenkins jobs, with each defaulting to "redacted" if not provided. This is a breaking change - operators must update their scripts to check for redacted values instead of deleted records.
Task List
No response