Soft delete and the Recycle Bin
Deleting a supported record in xMatix is normally a soft delete. The platform stamps the row with who deleted it, when, an optional reason and a Purge After deadline, and excludes it from ordinary entity queries — it disappears from lists, lookups and reports even though it is still stored. Until the deadline passes it can be brought back from the Recycle Bin.
- 1
Entities with deleted rows, each with a count; pick one to scope the grid — the bin never mixes entities.
- 2
The selected entity and how many of its rows are currently recoverable.
- 3
Deleted is when the row entered the bin; Reason keeps the optional explanation given at delete time.
- 4
Purge After is this row's actual deadline — after it the retention worker archives the row and self-service restore ends.
- 5
Restore returns this one row to the live population; tick several rows and use Restore selected for a bulk restore within the same entity.
Open the Recycle Bin from the App Launcher (it is listed with the apps, and administrators can add it to any app's navigation as the Recycle Bin item). The screen first lists every entity that currently has deleted rows, with a count; selecting one shows only that entity's soft-deleted rows with Name, Deleted, Reason and Purge After. Restore acts on one row; ticking rows and choosing Restore selected restores exactly those rows. Opening a row shows its stored field values, so you can check what you are about to bring back.
The retention window is 30 days by default (Purge After = deletion time + the configured retention days), so read the deadline from the row rather than assuming it. Rows deleted as part of removing a whole organization are excluded from the bin.
Delete and cascade are separate questions
The delete operation can affect related rows when a relation or feature handler is configured to cascade. That behavior belongs to the entity model and the specific delete path; it is not reconstructed by the Recycle Bin. Before deleting a parent record, inspect its relations and feature documentation rather than assuming either that every child follows it or that none do.
Ordinary application queries filter soft-deleted rows. Integrations or privileged maintenance paths can have different contracts, so verify the consumer rather than promising that every possible query hides deleted data in the same way.
Restore is row-scoped
Restoring a row clears its deletion timestamp, actor, reason and purge deadline, then saves that row back into the active population. Bulk restore performs the same operation for the IDs selected within one entity.
Restore does not walk a remembered parent-child deletion graph. If an order and its lines were deleted, restoring the order does not automatically restore its lines; locate and restore every required row explicitly, then validate the aggregate before returning it to users. References may also have changed while the row was deleted, so check lookups, uniqueness constraints and downstream balances after restoration.
Access to the Recycle Bin is not tied to an entity's Delete grant. In the current release the recycle-bin service checks only that the caller is signed in — it does not apply entity permissions or record security to the rows it lists or restores — so the practical control is whether the Recycle Bin app is visible to a user's profile. Keep that visibility to administrators.
What happens after Purge After
A platform retention worker runs on a schedule (hourly by default, where it is enabled for the deployment), finds soft-deleted rows whose Purge After has elapsed, writes their stored data to an archive and removes them from the live database. They then disappear from the Recycle Bin, so self-service restore is no longer available.
A platform operator can request recovery of individually identified archived rows. That process re-inserts them as soft-deleted rows — with their original deletion metadata and a fresh Purge After of now plus the retention window — so they reappear in the Recycle Bin for an administrator to review and restore; the restore is idempotent and skips rows that already exist. Archive recovery is row-scoped: requesting one parent does not reconstruct its related rows.
Before a bulk delete
- Resolve the exact population. Save or export the filtered IDs you intend to delete and have the business owner approve them.
- Map delete behavior. Inspect relations and feature handlers for cascades, blocks and cleanup actions.
- Export what recovery needs. The archive can preserve rows, but an approved business export makes identity and reconciliation easier.
- Record the deadline. Check the resulting Purge After values immediately after the operation; do not calculate the deadline from memory.
- Plan a row-by-row recovery set. Include child and linking entities that would be needed to reconstruct a usable aggregate.
- Validate references after restore. Recheck lookups, document lines, totals, security scope and any external system that consumed the deletion.
Common questions
Is deleted data destroyed immediately?
Not for records handled by the platform's soft-delete path. The row is hidden from ordinary entity queries and remains in the Recycle Bin until its purge deadline. A feature-specific hard delete or external-system deletion can behave differently, so verify the exact action before relying on recovery.
Does restoring a parent bring its children back?
No automatic cascade restore is implemented by the Recycle Bin. Restore the parent and each required child or linking row explicitly, then validate the complete business record.
What happens when the retention window expires?
The retention worker archives the row and removes it from the live database; it no longer appears in the Recycle Bin. Recovery then needs a platform operator to replay the selected archived rows back into the bin with a new grace window, after which an administrator restores them.
Can I change the retention window?
The window is a platform setting (30 days by default), not something an administrator sets per organization or per entity. Ask your platform contact if you need a different window.