paulsabou
Software in regulated industries must comply with:
- Auditability laws that require tamper-proof, long-term storage of event logs
- Privacy laws (GDPR) that require users’ personal data to be erasable on request.
Deleting data conflicts with the need for immutable audit trails — especially across backups and air-gapped storage.
Crypto-shredding is the solution to this dilemma.
Instead of deleting data, systems encrypt sensitive information with user-specific, time-scoped keys and later make it unreadable by deleting those keys.
Where Next?
Trending in Blog Posts
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
We build reliable cloud platforms for business-critical systems.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #ai
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #hex
- #security
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Master modern tools, write cleaner code, and tackle real-world challenges.
Producing high quality Elixir screencasts since 2017.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 2- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
NobbZ
For the moment.
We decided against crypto shredding in our event store, as we fear that future tech might make the encryption obsolete, do you have a solution for this?
paulsabou
agree that this is a valid concern. the concern is usually around post-quantum safe cryptography. Currently NIST recommands AES 256 with GCM for this. See SP 800-38D, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC | CSRC
Based on my research crypto shredding is the only way to have immutable audit event logs & gdpr compliance at the same time.
For EDA (Event Driven Architectures) you don’t have to guarantee event log immutability. If you trust that your code is bug free then you can always filter your primary event log stream and create a new one (with the user data removed).
My use case is not EDA but an auditable event log that has to be stored on an append only storage. In this case you literally cannot modify the event log (it’s on an append only storage system). Then the only option is crypto shredding.