Security

Assume the eraser is compromised.

Misuse outranks leakage. Controls bound who can delete, and how far one request can reach.

Boundary

Your account. Your PII.

Marketplace container in your VPC. Subject data never reaches Generational Wealth Productions. Only metering counts, and optional certificate hashes, leave.

Customer cloud boundary with sealed vault; PII stays inside
Duties

Four roles. No dual keys.

No single principal both edits the data map and approves an erasure.

Requester, approver, operator, and auditor as separated roles
  • RequesterCreates requests
  • ApproverApproves plans
  • OperatorEdits data map
  • AuditorRead-only proof
Cap Records / request Hard blast-radius limit
2× Approvers Required above bulk threshold
Quota Daily erasures Spike alerts on anomalies
Evidence

Tamper-evident by design.

Write-ahead hash chain. Object Lock mirror. DSSE + KMS. RFC 3161 timestamp. Optional Rekor head.

  • Hash-chained ledger
  • Refuse overwrite
  • Offline verify CLI
Certificate seal representing tamper-evident evidence
Locate returns references, not record contents
Minimise: connectors stream refs, never contents. Certificates store HMAC only.
Quarantine and sealed restore path
Restores: quarantine fails closed. Break-glass needs justification + replay.

Claims

  • Mapped sources processed as stated
  • Erased fields verified absent
  • Backup methods and dates listed

Does not claim

  • Unmapped stores are empty
  • Copies outside your accounts
  • Processors deleted, unless confirmed

Walk the threat model with us.

Request a review Product journey