Deletion proof

Produce evidence that customer data deletion work finished.

Chameleon connects warehouse deletion work, downstream cleanup receipts, and signed proof records so privacy teams can answer GDPR and DSAR deletion questions with evidence.

View demoTalk to us
Why it matters

Deletion workflow

Track a deletion request through warehouse handling, connected SaaS cleanup, and retained evidence.

Connected systems

Show proof across your warehouse (BigQuery or Snowflake) and connected systems such as HubSpot and Salesforce when those receipts are available.

Auditor-ready record

Generate a timestamped proof surface that links request id, affected systems, status, and evidence location.

The problem

"We ran the delete" is not evidence.

Most teams close a deletion request with a Jira ticket and a Slack message. That is fine until a supervisory authority opens an erasure complaint and asks what personal data the user had, which systems it lived in, when the request was actioned, and what mechanism guaranteed completeness. A closed ticket answers none of those questions.

GDPR Article 5(2) puts the burden of proof on the controller: you must be able to demonstrate compliance, not merely assert it. Deletion proof is the artifact that carries that burden — a record that stands up when someone who was not in the room reviews it months later.

How it works

One request, one auditable certificate.

Chameleon ties the deletion request to the PII registry to establish scope, coordinates warehouse erasure and connected SaaS cleanup, and collects a receipt from each system it reaches. The result is a signed, timestamped certificate that records the request id, the systems covered, the mechanism used, and where the underlying evidence lives.

Because the warehouse side uses crypto-shredding, the certificate can assert something a DELETE query cannot: that every copy protected by the destroyed key — including copies in backups — became unreadable at a specific moment. That is the difference between a claim and proof.

Trust, not take our word for it

Every certificate is independently verifiable — you don't have to trust Chameleon to check it.

A certificate is a signed JWT, and the field that actually gets set on deletion reads warehouseData: "CRYPTOGRAPHICALLY UNREADABLE" — not "deleted." That's a deliberate distinction: rows aren't physically removed, the per-user key that could ever decrypt them is destroyed, and the certificate says exactly that.

Certificates are also hash-chained per tenant: each new one embeds the SHA-256 hash of the certificate before it, plus a sequence number. Pull the full chain and you can prove nothing was quietly deleted from or inserted into the sequence — a tampered or missing certificate breaks the hash link to everything issued after it, not just itself.

Verification doesn't require Chameleon's cooperation at all. The signing key lives in Cloud KMS and is published as a standard JSON Web Key Set at /.well-known/jwks.json — the same discovery format OAuth and OIDC providers use — so any off-the-shelf JWT library can fetch the public key and verify a certificate's signature independently. The signing key itself rotates automatically roughly every 90 days; every certificate carries a kid claim pointing at the exact key version that signed it, so rotation never invalidates anything issued earlier.

Chameleon workflow
01 / Request

A deletion request identifies the customer record and the registry scope that needs review.

02 / Execute

Warehouse deletion handling and connected SaaS cleanup run through the configured workflow.

03 / Collect

Receipts and evidence are retained for affected systems instead of disappearing into separate tool logs.

04 / Issue

Chameleon presents a proof record that compliance teams can inspect during an audit or DSAR review.

Proof surface
request: delreq_2026_06_21_0042
status: certificate_issued
systems: BigQuery, HubSpot, Salesforce
evidence: gs://chameleon-audit-logs/lineage_exports/
FAQ

Common questions

What is deletion proof?

Deletion proof is verifiable evidence that personal data was erased — recording what was deleted, when the request was received and actioned, which systems were covered, and by what mechanism. It exists to satisfy GDPR's accountability principle, which requires controllers to demonstrate compliance rather than simply assert it.

Why isn't a completed DELETE query enough?

A DELETE query removes rows from one table but leaves copies in backups, derived tables, and downstream tools, and it produces no durable evidence. Auditors ask for a record of scope, timing, mechanism, and completeness — none of which a query log provides on its own.

How does deletion proof work across SaaS tools?

Chameleon sends cleanup instructions to connected systems such as HubSpot and Salesforce and collects a completion receipt from each. Those receipts are attached to the same proof record as the warehouse evidence, so a single certificate covers the warehouse and the downstream tools together.

How do I verify a certificate is authentic, without just trusting Chameleon?

Every certificate is a standard signed JWT. Fetch the public key set from the /.well-known/jwks.json endpoint — the same discovery format OIDC providers use — and verify the signature with any off-the-shelf JWT library, no Chameleon-specific tooling required. Certificates are also hash-chained per tenant, so pulling the full chain lets you independently confirm none were quietly removed or inserted.

What happens to old certificates when the signing key rotates?

Nothing — they stay verifiable. The signing key rotates automatically on a schedule (roughly every 90 days by default), but every certificate carries a kid claim identifying the exact key version that signed it, and old key versions are never destroyed, only retired from new signing. The JWKS endpoint publishes every active version, so a verifier just looks up the kid on the certificate against the current key set.

Keep reading