Audit Log Service  ·  View 25 of 40  ·  5 · Runtime

Disposal

Seven steps that close a loop, and the answer to the fifth core question given as a sequence rather than a choice.

Editable source SVG draw.io All views
Class Assigned at commit, in storage Expiry Computed retention_until Hold Check 4 granularities Key Destroyed segment DEK in HSM Certificate Signed class, range, count Tombstone Linked root retained Bytes Removed lifecycle, lock expired Disposal within 30 days of expiry policy, not code nightly scan no hold applies record unreadable written back in range still verifies class reassigned on renewal Disposal — A Governed, Evidenced Act Application we own Decision point Security / platform Data store Question 5 answered as a sequence rather than a choice. Crypto-shredding makes the record unreadable the moment the key dies, while the ciphertext waits for the retention lock to expire before the lifecycle rule can remove it — so the erasure is instant and the deletion is still real. v 1.0 · owner Data & AI Global Practice · date 2026-09

Question 5 answered

  • Both, in order. Crypto-shredding destroys the segment's data key in the HSM the moment retention expires and no hold applies — the record becomes unreadable instantly and irreversibly. The ciphertext then waits for the retention lock to expire before a lifecycle rule removes the bytes.
  • Shredding alone would leave 'the ciphertext still exists', which satisfies some regulators and not others, and inherits every future cryptanalytic risk. Physical deletion alone leaves a hole in the chain that verification cannot distinguish from tampering.
  • Doing both, with a tombstone linking the retained Merkle root to a signed certificate, gives erasure that is immediate and deletion that is real, over a range that still verifies.

The certificate

  • Names the retention class, the range, the record count and the policy under which disposal occurred, is signed, and is written back into the audit log as an ordinary record.
  • Disposal happens within 30 days of expiry. A range under legal hold is skipped and the certificate for the surrounding range says why it waited.
  • The retention engine acts only on records it did not create, under a schedule it cannot shorten.

Risks

  • Crypto-shredding is only as final as the key destruction. Managed HSM purge protection and soft-delete windows must be configured so that a destroyed key cannot be recovered by anyone, including Microsoft support — this needs explicit confirmation before the first disposal window runs.
◀  Evidence Bundle and Offline Verification All views Legal Hold  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source25-disposal-lifecycle