Soft-delete is not erasure

Tombstones

A tombstone (or soft-delete flag) is useful: it stops the app from treating the user as active, preserves referential integrity, and gives operators a chance to undo mistakes. It is not erasure.

• Personal fields (name, email, IP, content) often still sit in the row or in related tables.
• Indexes, search replicas, and caches may still return identifiable data after the UI says “deleted.”
• Honest erasure either removes the personal data or irreversibly anonymises it — then records that action, not merely the hide flag.

Prefer: wipe or anonymise PII → write an immutable deletion record (who/what/when/method) → keep only what you truly need for integrity or legal retention.

Backups

Point-in-time recovery and nightly snapshots will still contain the pre-erasure state until those backups expire. Claiming “deleted everywhere” while a 30-day backup window holds the full row is inaccurate.

• Know the window — how long snapshots retain identifiable copies.
• Say it in the reply — if live systems are erased but backups expire on {date}, state that.
• Do not promise tape miracles — surgically editing every historical backup is often impractical; expiry + access controls are the usual honest path for small teams.

Third-party SaaS

Your product is rarely the only processor. Billing, email, analytics, support, and error tracking may hold the same subject. Soft-deleting your users table does not delete their Stripe customer or Intercom contact.

• Keep a short subprocessor list you actually use.
• For each, know the deletion / anonymisation path (API, dashboard, ticket).
• Scope your certificate to systems you ran — do not imply vendors you never checked were wiped.

Operational checklist for mapping those systems: DSAR checklist for solo founders.

Certificate of deletion

A useful certificate is a signed, datestamped statement of what you did — not a guarantee about the entire internet. Honest contents usually include:

• Subject identifier and request type
• Sources / systems in scope
• Method (hard delete, anonymise, vendor ticket id)
• Timestamp and an integrity signature so the PDF cannot be quietly edited later

It should not claim independent storage-fabric audits, zero backup residue, or vendor wipes you did not perform. Overclaiming is worse than a narrow, accurate attestation.

CTA — Waymark Deletion

Waymark Deletion helps small SaaS teams run a scoped erasure job and export a signed PDF certificate for what that job covered. Free: 1 deletion per month. We do not invent uptime or customer logos on the product page.

Related

• Waymark Deletion — product page
• DSAR checklist for solo founders
• GDPR account deletion for indie SaaS
• Waymark home