Vord

Architecture Decision Record

0034. Right-to-erasure and crypto-shredding

Context

CIAM at millions of users means GDPR / CCPA right-to-erasure, which conflicts with the append-only identity event log (ADR-0022): you cannot delete a subject's data from an immutable, replayable stream without destroying the audit trail's integrity. The privacy work was reserved (ADR-0027 / §12.7); this ADR settles the mechanism, because the conflict is architectural, not a checklist item.

Decision

  1. Crypto-shredding. Each principal's PII is encrypted under a per-principal data key: a locally-generated envelope key assigned at principal creation (ADR-0011 decision 2), stored wrapped under a realm key-encryption key held by KeyCustody (ADR-0003 / ADR-0023) — so creating a principal costs no KMS round-trip, which matters at CIAM registration rates (ADR-0012). Erasure = destroying that key, which renders the subject's PII — including what is recorded in the immutable event log and its projections — permanently unrecoverable, without mutating the append-only stream.

  2. The event log stays append-only (ADR-0022). Erasure is itself recorded as an event ("the subject's key was destroyed at T"), so the audit trail's integrity and replayability survive while the subject's data becomes unreadable. Replaying the stream after erasure yields ciphertext no one can open. The event doing double duty closes the backup hole: a restore (ADR-0040) replays erasure events recorded since the backup point before serving traffic, so a backup can never resurrect a destroyed key.

  3. Erasure is a composite act, not key destruction alone. Destroying the key covers every encrypted surface — event log, projections, profile records, session-record PII, SCIM representations. Two things are done explicitly besides: the principal's blind-index entries are deleted (ADR-0011 decision 3 — freeing the identifier for re-registration and leaving nothing searchable), and the principal's live artifacts are killed — sessions terminated (ADR-0016) and outstanding tokens revoked via the status list (ADR-0005) — so erasure ends access, not only readability.

  4. Retention policies per tenant/realm (ADR-0012): data and projections carry retention windows; the directory (ADR-0011) holds the per-principal key reference and the blind identifier index, never PII in clear.

  5. The self-service deletion request (proposal 0010) and operator-initiated erasure both trigger this mechanism; it composes with per-tenant residency (ADR-0012).

Consequences

  • GDPR / CCPA erasure is satisfied without breaking the constitution's append-only event stream — the immutable audit log survives because erasure is key destruction, not record mutation.
  • "Delete my data" is bounded and provable (the key is gone), and is itself audited.
  • Per-principal keys add key-management surface (creation on principal creation, destruction on erasure, and the envelope-key lifecycle, ADR-0023) — accepted as the cost of reconciling immutability with erasure.
  • This is the privacy/data-protection decision §12.8 flagged; it resolves the deletion-request handoff from proposal 0010. Refines ADR-0011, ADR-0023, and ADR-0022.