Canceling and terminating a server

Cancel = at-period-end; terminate = immediate destroy. Both reversible up to a point.

Two flows that look similar but mean very different things.

Cancel (customer-initiated)

From /dashboard/servers/[id] → Cancel. Server moves to PENDING_CANCEL. It keeps running until the current billing period ends; on that date the Stripe webhook fires customer.subscription.deleted and we transition to TERMINATING.

Uncancel: from the same page, click Uncancel any time before the period ends. Subscription is reactivated, server stays running, no extra charge.

Terminate (admin-initiated)

From /admin/servers/[id] → Force terminate. Used for abuse, irrecoverable failure, or post-30-day-suspension cleanup. State goes directly to TERMINATING. A 7-day grace period applies — the server isn't actually destroyed for 7 days, giving us time to recover from a misclick.

Final backup

Before destruction, a BackupArtifact with kind FINAL is created (full disk image to S3). Retained 30 days. After that, gone.

What's destroyed

The VPS, attached volumes, primary IPv4 reservations, and snapshot images. The Cloudflare A record is also deleted. The Subdomain row is freed so a future customer can claim that subdomain.