Couple of techniques; Per-record keys where the key can be deleted (this is a hard delete as your system can no longer access the data). Keep "sensitive" info

Couple of techniques; Per-record keys where the key can be deleted (this is a hard delete as your system can no longer access the data). Keep "sensitive" info out of messages (credit card stuff, PII, secrets?, whatever), events have pointers to a store just for this. All code that accesses sensitive data has to have guards in case the lookup fails. Deletion is really interesting and forces its way into your domain. For example you might be in a position where you have to delete all info about someone except their payments because AML forces you to keep those for X years.