3 ms·

Any architecture that facilitates this will lose massive amounts of customer data, full stop. Backups have to be in places where live systems can't touch them,

Any architecture that facilitates this will lose massive amounts of customer data, full stop. Backups have to be in places where live systems can't touch them, or can append only. Backups have to be offline and immutable. If you can mutate a backup based on a user request, it's not a backup. Offline backups are, however, pretty hard to steal (unless you're stealing the physical tapes). So... immediately, maybe. Completely, no fucking way.

icebraining 11y ago
That's what encryption is for - burn the key, and the backups are useless even if they're immutable.
- superuser2 11y ago
  Which is going to throw out all the other users' data too. Unless you have one key per user, in which case those also need nontrivial backup.
jlgaddis 11y ago
Right, but eventually the older backups (still containing Joe Public's data) will go away. Depending on how long you retain backups it may be anywhere from a few days to perhaps a few months but at least it will be gone from the live systems immediately.