3 ms·
> backups that cannot be deleted / overwritten That gets complex if your database contains PII. If a user asks for their account to be deleted...
by varispeed 6y ago
> backups that cannot be deleted / overwritten
That gets complex if your database contains PII. If a user asks for their account to be deleted...
- tomrod 6y agoWould it be sufficient that the delete accounts script be managed and merged at restoration time?
- marcinzm 6y agoYou still have their data and anyone who bypasses the restoration script can get it so no.
- anang 6y agoThis is not true. The prevailing opinion is that backups do not need to be modified and that it’s enough to delete at restore time (and to of course not process the data again).
- varispeed 6y agoThe neatest way I heard is to store PII in an encrypted form and then delete encryption keys when a user requests deletion. That requires the keys to be in a different backup pipeline though.
- viraptor 6y agoIt's not "cannot be overwritten ever". It's more "you can overwrite it using credentials stored in a safe location and never from the production environment". Someone will always have permissions to remove or change the entries, just not easily and not in an automated daily process way.