Privacy evidence
Privacy evidence you can actually show
When someone asks what happened to a user's data, you need more than a pile of logs. This page covers what operational proof looks like—and what it can't be.
What evidence means here
Evidence is an exportable package built from real product events: what was published, what each person chose, what deletion ran, and whether it succeeded or failed. It answers one question: can you prove what happened?
What counts as proof
Four things, and each has a concrete artifact behind it:
- What the person was shown—a snapshot of the notice or consent version.
- What they chose—the receipt, tied to that version.
- What ran on a deletion—the job, the systems, the outcomes.
- What failed—honest statuses, not a clean 'all done' fiction.
What evidence is not
An exportable record is not a legal seal, not a compliance score, and not a certification. If someone markets 'court-ready hash-chained evidence' to you, that is theatre. Operational evidence is useful precisely because it is boring and verifiable.
How Erasure fits
Evidence is a shared capability on the platform, assembled from events Erasure already records:
- Consent publish evidence from the published version and its receipts.
- Deletion evidence from the case lifecycle and per-system outcomes.
- Export as JSON, CSV, or a readable report.
- Partial failures surface as failed steps—nothing is papered over.
Read more
Audit Trail vs Evidence: What Privacy Review Actually Needs
A server log is not an audit trail, and an audit trail is not evidence. When a reviewer asks what happened, you need a portable record, not a query into noisy logs.
How to Handle Data Deletion Requests: An Operational Guide for Startups
A practical workflow for handling data deletion requests in an Indian startup: intake, verification, fulfilment across systems, timelines, and evidence. No compliance team required.
Right to Erasure Under DPDP: How Deletion Requests Actually Work
The right to erasure under India's DPDP Act is the operational heart of the law. Here is how a deletion request flows from receipt to verification to fulfilment across systems.
Consent Receipts: Why Proof of Consent Is the Real Compliance Asset
A consent receipt records what a user saw, what they chose, and when, in a form that survives configuration changes. Under DPDP, the receipt is the difference between a banner and a defense.
Docs
What this does not solve
Evidence v1 is JSON, CSV, or a report—no PDF, no cryptographic seal, no SIEM. It documents Erasure-mediated actions; it is not a substitute for your own audit processes or legal records.
Invite-only beta
Try it on your own stack
Erasure is invite-only in beta. Request an invite and we will walk you through the parts that matter for your product.