GDPR Art. 17 · CCPA · signed PDF audit trail

Delete users.
Stay compliant.
One API call.

NukeAPI deletes a user from Stripe, Mailchimp, HubSpot, Intercom, and your database in parallel — and provides a signed PDF audit trail. Live in 15 minutes.

Free Sandbox · 20 deletions/month · No credit card required

15min

to first deletion

integrations

207/429

honest statuses

POST /api/v1/delete-user200 OK

curl -X POST https://www.nukeapi.dev/api/v1/delete-user \
  -H "Authorization: Bearer nk_live_••••••••" \
  -H "Content-Type: application/json" \
  -d '{
    "subject_email": "jane@acme.com",
    "integrations": ["stripe","mailchimp","hubspot"]
  }'

RESPONSE · 200 OK · 48ms

{
  "status": "completed",
  "results": [
    { "integration": "stripe",    "status": "success" },
    { "integration": "mailchimp", "status": "success" },
    { "integration": "hubspot",   "status": "success" }
  ],
  "auditSignature": "a1b2c3…"
}

How it works

Live in 15 minutes

Get your API key

Connect integrations

Paste your Stripe, Mailchimp, and HubSpot keys in the dashboard. Encrypted at rest, takes 3 minutes.

Call the API

One POST with the user email. Fan-out runs in parallel with timeout + retry and honest partial results.

Keep the signed PDF

Every deletion is HMAC-signed and downloadable — the exact artifact auditors ask for.

Why NukeAPI

Everything you need. Nothing you don't.

⚡

Parallel execution

All integrations run in parallel — one failure never hides another result.

📄

Signed PDF audit trail

HMAC-SHA256 over the canonical result, stored on the row and embedded in the PDF.

🔁

Retry with backoff

10-second timeout with automatic retries on transient errors; client errors are never retried, and a slow provider cannot stall your request.

🔑

Honest API keys

API keys are hashed and never stored in readable form. Each key is shown only once, at creation.

🛡️

Zero plaintext creds

AES-256-GCM encryption at rest. The browser never sees the key, and the database never stores plaintext.

📊

Usage that adds up

Atomic usage metering — concurrent deletions cannot undercount your quota.

Integrations

Covers your stack

78 integrations — 6 live today, more shipping monthly

StripePayments

MailchimpEmail

HubSpotCRM

IntercomSupport

SupabaseDatabase

PostgreSQLDatabase

SalesforceCRM · soon

SegmentCDP · soon

KlaviyoEmail · soon

SendGridEmail · soon

Auth0Auth · soon

ClerkAuth · soon

PostHogAnalytics · soon

ZendeskSupport · soon

MixpanelAnalytics · soon

MySQLDatabase · soon

PlanetScaleDatabase · soon

NeonDatabase · soon

MongoDBDatabase · soon

FirestoreDatabase · soon

ConvertKitEmail · soon

ActiveCampaignEmail · soon

ResendEmail · soon

DripEmail · soon

AmplitudeAnalytics · soon

FullStoryAnalytics · soon

HeapAnalytics · soon

JuneAnalytics · soon

Need another system? Request it →

Pricing

Pay for what you delete

No seats. No hidden fees. Cancel anytime. Secure checkout via Dodo Payments.

2 months free

Sandbox

Free

✓20 deletions/mo
✓Up to 3 integrations
✓No overage fees

Start free

Startup

$990/yr

$82.50/mo billed annually · 2 months free

✓200 deletions/mo
✓Up to 12 integrations
✓No overage fees
✓Signed PDF audit trail

Choose Startup

Business

$2,990/yr

$249.17/mo billed annually · 2 months free

✓1000 deletions/mo
✓Up to 25 integrations
✓No overage fees
✓Signed PDF audit trail

Choose Business

Enterprise

$6,990/yr

$582.50/mo billed annually · 2 months free

✓Unlimited deletions/mo
✓Unlimited integrations
✓No overage fees
✓Signed PDF audit trail

Choose Enterprise

Compliance

Built for the legal reality

GDPR gives you 30 days, CCPA 45. Miss it and fines reach up to €20M or 4% of global revenue — whichever is higher. Every deletion produces a signed PDF your lawyers can file.

GDPR

30 days deadline

up to €20M or 4% of global annual revenue, whichever is higher

CCPA/CPRA

45 days deadline

up to $7,500 per intentional violation

LGPD

15 days deadline

up to 2% of revenue in Brazil, capped at R$50M per infraction (ANPD)

Why it matters

One missed deletion request can cost more than your stack

Every product with user accounts receives erasure requests — GDPR Article 17, CCPA deletion rights, LGPD confirmation requests. Each one starts a legal clock, and the data lives scattered across your payments, CRM, email, auth and database systems.

⏱️

The clock

30 days under GDPR, 45 under CCPA/CPRA, 15 under LGPD. A manual runbook across 5+ dashboards rarely finishes in time — and "we couldn't find them" is not a defense.

⚖️

The penalty

up to €20M or 4% of global annual revenue, whichever is higher · up to $7,500 per intentional violation · up to 2% of revenue in Brazil, capped at R$50M per infraction (ANPD). Beyond fines: processing orders, lawsuits, and customers who leave after a breach of trust.

🤖

The automation dividend

Connect each system once. Afterwards one API call fans out in parallel with timeout and retry, and returns an HMAC-signed PDF your lawyers can file. No runbooks, no manual dashboard work, no spreadsheet tracking.

Connect in minutes

Paste API keys in the dashboard. AES-256 encrypted at rest, never in your codebase.

One POST per request

Send the user email. Every live integration runs at once; partial results stay honest (HTTP 207).

File the proof

Each run produces a signed audit PDF — deletion evidence on demand, not a scramble.

Developer-friendly by design: copy-paste curl, Node and Python examples in the docs — most teams go live the same day.

FAQ

Questions, answered

How fast can I go live?

About 15 minutes: sign up, connect one integration, create a key, send your first POST. The docs page has copy-paste examples in curl, Node, Python, and five more languages.

What happens if one integration fails?

You get HTTP 207 partial with per-integration status. Stripe can succeed while HubSpot fails — nothing is silently dropped, and usage still counts the attempt.

How does billing work?

Checkout is via Dodo Payments. The webhook upgrades your plan automatically. Cancel anytime from settings — access continues until the end of the billing period.

Is my data encrypted?

Yes. Connector credentials are encrypted with AES-256-GCM before storage. API keys are bcrypt hashes. Audit rows are HMAC-signed.

Your next data-subject request could arrive at any time.

Be ready before it arrives. 15 minutes to full integration. First 20 deletions free.

Delete users.Stay compliant.One API call.