Handle an erasure request

A data subject’s right-to-be-forgotten request. AOCore provides both halves — export what is held about them, and erase it — with the erasure itself recorded in the audit chain.

Export first

Run the export before the erasure, even when only erasure was asked for. Once erased the data is gone, and you may still need to evidence what was held and that it was removed.

1. Open /data-exports.

2. Create an export for the subject. It gathers their records across users, keys, spend history and knowledge documents.

3. Download it when it completes.

Then erase

1. Open /erasure-requests.

2. Create the request for the subject.

3. Track it to completion. Erasure is asynchronous and spans several tables.

What erasure does and does not remove

This is the part to get right before promising anything to a data subject.

Removed: the user record, their PII, and personal content in prompts and responses attributable to them.

Retained by design:

• Audit log entries. The chain is append-only and hash-linked — deleting an entry breaks verification for everything after it. Entries are redacted in place rather than removed, preserving both the chain and the fact that an action occurred.
• Aggregate spend. Rolled-up totals contain no personal data and are usually required for billing and financial records.

Both are standard positions under GDPR’s exemptions for legal obligation and for records that are no longer personal data once aggregated — but they are your determinations to make, not the platform’s. Confirm them with whoever owns your data-protection position before responding to a subject.

Soft deletion and the purge window

Deleted records first move to /trash, where they remain until a scheduled job purges them. Two consequences:

• An accidental deletion is recoverable during the window.
• An erasure is not complete until the purge runs. If a subject asks for confirmation, confirm after the purge, not at request time.

Consent

/consent-policies records the consent basis under which data is processed. Reviewing it alongside an erasure request tells you what was agreed to, which often determines whether erasure is required or merely requested.

Evidence for the file

/compliance-reports produces a point-in-time artifact covering the window. It carries the audit-chain verification result alongside the entries, which is what makes it usable as evidence rather than merely a data dump — see Verify the audit chain.