Shredded Except Here

Every user's event payloads are encrypted under a per-user KMS key, so erasure is implemented as crypto-shredding. More than one option below is correct.

def erase_user(user_id: str) -> None:
    kms.schedule_key_deletion(
        KeyId=f"alias/user-{user_id}", PendingWindowInDays=7
    )
    db.execute(
        "UPDATE users SET email = NULL, full_name = NULL WHERE id = %s",
        user_id,
    )
    db.execute("DELETE FROM sessions WHERE user_id = %s", user_id)

Assume the scheduled deletion has since completed. Which of these still hold recoverable personal data?

The 30-day database snapshot taken last week, which predates the UPDATE and still holds the email and name in the users row.

The users row itself, which still exists with its primary key after the two identifying columns are set to NULL.

The nightly analytics table fct_orders, which is built by decrypting events and materializing customer_email as a plain column.

The search index, which stores the display name as an analyzed text field so autocomplete can match on it.

The encrypted archive segments in object storage, whose per-object data keys are wrapped by the key that has just been destroyed.