deletion as a key ceremony — provable, complete, effective across backups.
Delete people from your AI. Prove it.
When someone must be removed from your AI systems, Deletable destroys their key — their data becomes cryptographically unrecoverable at once, including in backups — then deletes the underlying data within a defined window, and issues a certificate that states exactly what was verified.
- key destroyed
- unrecoverable in backups
- deletion certificate
- custody you control
Deletion is a promise, not a proof
When a company is asked to delete someone's data, the honest answer is usually "we think so." Data spreads into caches, backups, replicas, and AI-derived state. Removing it everywhere, and showing that you did, is genuinely hard.
Unlearning doesn't work
Removing a person's influence from a trained model is approximate and hard to verify. The reliable path is architectural: make sure their data only ever lived in key-scoped state, so deletion becomes destroying a key.
Deletable makes deletion an event you can prove, not a promise you make.
A phased lifecycle
- 01
Destroy the key (immediate).
Each subject’s data is held under its own key, derived through a per-subject key tree. Destroying that key orphans everything beneath it in one operation — the data is cryptographically unrecoverable at once, backups included. This step is self-verifying: no key opens the data, and anyone can confirm it.
- 02
The verifiable window.
A defined window follows, during which deletion propagates and can be checked. The window is a stated security parameter: longer means more time to verify and more exposure, and the certificate records which you chose.
- 03
Destroy the data.
The underlying encrypted data is then removed from storage, backups, and replicas, and the certificate advances to record it.
Deletable attests destruction of data within its keyed boundary. It does not certify that no copy ever escaped that boundary, and it does not delete data from merged model weights. The certificate enumerates exactly what is and is not covered.
Every deletion produces a certificate in two clearly separated parts.
Holds even if we lie.
Coverage was not narrowed. No key opens the data. The binding to the subject is intact. Influence is gone. You can check every one of these yourself, without trusting us.
Signed by us.
The key-destruction event and the custody mode, signed. The evidence above is independently checkable today; independent signature verification is on the roadmap. We say which parts you must take on trust, and we are working to remove them.
A certificate that says what it proves, and admits what it only attests.
The obvious question a DPO asks: what stops you reversing an erasure?
Deletable's trust root is pluggable. Under customer-held custody, the vendor structurally cannot hold the key that would undo a deletion — and the certificate records the custody mode, measured from the live system, so a weak configuration cannot present itself as a strong one.
Deletable governs the surfaces where personal data actually lives in an AI stack.
Retrieval & vector state
LIVEPer-subject deletion across vector search, running on the deletion spine today. Encrypted and bound to the subject at rest; wrong-subject reads return nothing; recall preserved under keying.
Serving & agent memory
SAME SPINEKV-cache and session memory sit on the same key tree. Not yet covered by the current certificate — stated explicitly, not implied.
Model weights
OUT OF SCOPEMerged weights are not deletable, and Deletable says so. The architecture’s job is to keep personal data out of weights and in deletable, key-scoped state.
The lane
Machine unlearning
Retroactively remove a person’s influence from a trained model. Approximate, hard to verify, and publicly documented as unreliable.
Deletable
Architect so personal data only ever lives in key-scoped state. Deletion becomes a key ceremony: instant, complete, effective across backups, and certified. Prevention with proof, not retroactive erasure.
Manual deletion
Find and remove data by hand across systems. Doesn’t scale, and ends in “we think so.”
DSAR platforms route the request. Deletable is the enforcement layer they route to.
Built on the Cittela isolation primitive. Per-subject crypto-erasure, filed UK provisional patents (GDC-J, GDC-K).
Part of the Cittela family. Isolation at isovert.com, confidential vector search at nabladb.com.