Product

From request to seal.

Four beats. One certificate. Everything else is detail for the people who have to run it.

Locate, erase, verify, certify workflow
  1. 01 LocateExpand identity. Find refs.
  2. 02 EraseDelete, anonymize, or shred.
  3. 03 VerifyFresh read must be empty.
  4. 04 CertifySign. Timestamp. Seal.
Data map

You declare the estate.

A versioned shredproof.yaml names each source and action. Discovery flags gaps; it never deletes what you did not map.

subject:
  primary_key: customer_id
sources:
  rds.core:
    kind: postgres
    tables:
      customers: { action: delete }
      invoices:  { action: retain, basis: tax_7y }
  s3.uploads:
    kind: s3
    action: delete_all_versions
v1 sources

AWS first. Same trait forever.

New clouds are new crates; the certificate model does not change.

Connected AWS data sources with verification checks
  • RDS / Aurora
  • DynamoDB
  • S3
  • OpenSearch
  • CloudWatch Logs
  • AWS Backup
Backups

Two honest methods.

Crypto-shred makes every copy unreadable at once. Tombstone replay suppresses the subject when a backup is next restored.

Crypto-shred
Tombstone on restore
Subject key dissolving; backups become unreadable
Signed deletion certificate with seal
Certificate

Evidence, not an email.

JCS + DSSE, your KMS key, RFC 3161 timestamp. Offline verify. No PII; subject is an HMAC.

Run it on a synthetic subject

Prefer a demo over a deck.

Book a design-partner call Security model