Every privacy policy promises deletion and asks you to take it on faith. You click "delete my data," a confirmation appears, and you have no way of knowing whether the record is gone, archived, or sitting in a backup someone forgot to prune. We decided that faith is the wrong currency for the right to be forgotten. So deletion in Hub now ends with a receipt — proof that the thing was erased, verifiable by anyone you hand it to.
The right to erasure is one of the strongest rights in European data law, and it's also one of the hardest to audit. A company can claim it deleted your data as easily as it can claim it kept your data safe — both are assertions you can't independently check. The whole category of compliance theatre lives in that gap between the claim and the proof. Deletion is where the gap is widest, because by definition there's nothing left to point at.
Our version doesn't just remove the record — it destroys the key that record was encrypted under, so what's left is scrambled data nobody can ever unlock, including us. That's crypto-shredding: the data is unrecoverable by mathematics, not by housekeeping. And the act of shredding mints a deletion receipt — a tombstone recording that a record existed, that it was erased at a specific moment, and that it can't be brought back. The receipt is public-verifiable at verify.dekimu.com; the data it refers to is gone.
We'd rather name the limit than oversell the feature. A deletion receipt proves we destroyed the key under our control at the time it claims. It can't speak for a copy you exported to your own laptop, or a screenshot a client took — nothing can, and any tool that claims otherwise is lying. What it does do is close the part of the loop that was always taken on trust: the part where the company that held your data swears it let go. Now it doesn't swear. It shows you.
Anyone can say "we deleted it." The honest version is a tombstone a stranger can verify and a key that no longer exists — so that even we couldn't undo the deletion if we wanted to.
This is shipped and running — erase the relevant data in Hub and the receipt is minted as part of the deletion, end to end. It joins the rest of the verifiable-record family: consent, payment proofs, notices, sign-offs, and now forgetting. The throughline is the same one we keep coming back to. The strongest thing a tool can do with your trust is not ask for it.