Consent & Privacy Service · View 14 of 22 · Runtime
Decisions
- The erasure technique is declared per target in the registry, in advance: hard delete, crypto-shredding, filter-and-re-derive, or tombstone-plus-suppression. The technique is evidence, not an implementation detail.
- Verification is the platform's own act, not the target's claim. A probe that still returns data after an attestation of completion is a finding against that system's owner.
- A legally retained category produces a recorded refusal with a reason the subject can read, re-reviewed when the statutory period expires — not a silently skipped target.
The empty cells
- A manual recipient cannot be verified by the platform. That gap is drawn rather than hidden, and it is tracked as an open obligation with an owner and a due date.
- A legal retention has nothing to attest. Its fourth state is a scheduled re-review, which is the only honest completion available.
Assumptions
- Roughly 100 targets per erasure: 40 first-party systems, 60 recipients, of which a minority have no programmatic mechanism.
- Sampling gives ≥ 99% confidence of detecting a target with a ≥ 1% residual-data rate within 7 days.
