Add-ons need a hook that will indicate with confidence when a tenant has been shutdown and destroyed. Without this, there is no safe way to remove/archive add-on-side data associated with that tenant.
In addition, after being notified of the tenant's destruction, add-ons may wish to do due diligence to make sure the tenant really is gone before permanently removing its data (e.g. ensure it has been unresponsive for N consecutive days). Some best practice documentation on this topic would be valuable.
A complexity is that this will probably require tenant lifecycle hooks that originate from outside of JIRA/Confluence.
This came up during Sydney Connect week.