Prove Data Is Unrecoverable, Not Just Deleted
Right-to-erasure used to be simple. A data subject asked, the records team ran a delete query, the audit log showed the deletion, and the case was closed.
Three regulatory shifts changed that:
GDPR Article 17 puts the burden of proof on the company holding the data. You now have to show the data is unrecoverable, not just that you intended to delete it.
Schrems II raised the bar on cross-border data residency. Whether data is recoverable in another jurisdiction is now part of the question.
India's DPDP Act, the EU AI Act, and various US state privacy laws all converge on the same standard: destruction that can be verified, not just asserted.
TeamSync's approach is to make the data unreadable by destroying the encryption key it depends on. The encrypted bytes can still sit in a backup tape or an old log file — they're mathematically unreadable either way.
Talk to the privacy solutions team · Read the GDPR Article 17 overlay · See the Crypto-Shred capability
What "Cryptographic Shredding" Really Means
Most platforms treat erasure as a deletion step: the record is removed from the production database, but a copy often still sits in backup tapes or offline archives. The audit log says "deleted," but the data itself is still recoverable from one of those secondary stores.
Crypto-shred works differently. Data is encrypted at the time it's written, using a key specific to that customer. When an erasure request comes in, the key is destroyed. Wherever the encrypted data still exists, it becomes unreadable.
Stage | What it requires |
Per-tenant encryption | Each customer has their own encryption key |
Key custody | Keys are held in hardware security modules, with a two-person process required to destroy one |
Encrypted persistence | Data stays encrypted everywhere it lives — production, backups, archives |
Erasure as key destruction | An erasure request destroys the key; the data becomes unreadable everywhere it exists |
Verifiable proof | The destruction event is logged to the audit ledger and can be independently checked |
The difference is between "we believe it's gone" and having mathematical proof that it is.
What Changes When The Key Is Destroyed
Crypto-shred answers four common situations:
Situation | What crypto-shred provides |
GDPR right-to-erasure request | A verifiable proof of destruction closes the request defensibly |
Cross-border data residency requirements | Destroying the key in a specific jurisdiction makes the data unrecoverable there |
A customer leaving a multi-tenant platform | Their data becomes genuinely unrecoverable, not just contractually promised to be deleted |
Health data (PHI) erasure requests | Meets HIPAA and similar state-level requirements with the same mechanism |
What This Means For Your Organization
For privacy and security teams, this changes what a right-to-erasure request actually involves.
Activity | Before crypto-shred | With TeamSync |
Right-to-erasure response | Delete the record, log it, hope it's enough | Destroy the key, generate cryptographic proof |
Backup-tape recovery risk | A real, ongoing risk | Removed, since the key no longer exists |
Cross-border residency proof | A procedural explanation | A verifiable cryptographic fact |
Proof of destruction after tenant offboarding | "Trust our process" | "Check the math" |
Defensibility under GDPR Article 17 | An argument | A proof |
What You Keep
Crypto-shred isn't a bolt-on feature. It's a direct result of how TeamSync encrypts data by default, so there's nothing extra to configure or maintain.
What's already built in | What it gives you |
Per-tenant envelope encryption | Every customer's data is encrypted with its own key, by default |
Hardware-backed key custody | Keys are stored in hardware security modules, accessible only through controlled operations |
Two-person destruction process | No single person can destroy a key alone; the process is logged to the audit ledger |
Customer-controlled keys (CMK) | You can hold the master key yourself; TeamSync can't decrypt your data without your authorization |
Bring-your-own/hold-your-own key options | Available for deployments with strict, regulator-mandated key custody requirements |
How TeamSync Compares
Crypto-shred at this depth is uncommon in the document platform space. The closest comparisons:
Microsoft Purview Customer Lockbox + Customer Key — strong within M365; the cryptographic proof of destruction is only partial
AWS KMS + S3 server-side encryption — strong at the storage layer; the document-platform integration and the right-to-erasure workflow still need to be built on top
In-house envelope encryption — the most flexible option, but the destruction process, audit logging, and the case for regulator acceptance all need to be built from scratch
For specific comparisons:
- TeamSync vs SharePoint + M365
- TeamSync vs Box
Read Further
GDPR Article 17 overlay — the regulator-specific pack
HIPAA overlay — the PHI right-to-erasure application
RBAC + Backup capability — the underlying capability
Why TeamSync — tamper-evident audit — the chain that anchors the destruction event