Privacy by design #

An immutable, append-only data model and the GDPR “right to erasure” seem to contradict each other. Prexfo resolves this contradiction elegantly in technical terms — and makes privacy a built-in feature, not a retrofit.

The challenge #

Article 17 GDPR gives data subjects the right to demand erasure of their personal data. A system that by design deletes nothing physically appears incompatible with this at first.

Two observations defuse the conflict:

  1. The GDPR does not require physically overwriting disk blocks. It requires that the data be inaccessible to anyone and the person no longer identifiable.
  2. Article 17(3) has exceptions: statutory retention obligations (German HGB, AO) for contracts and statements override the right to erasure — the norm in property management.

Crypto-shredding as the solution #

Instead of deleting data physically, Prexfo makes it cryptographically and permanently unusable:

  1. Every entity with sensitive data (e.g. a person under PERSONS/) is encrypted with its own strong key (AES-256).
  2. The keys are stored separately from the data in a secure key management system (KMS).
  3. On a valid erasure request, the immutable file is not touched — instead the corresponding key is irrecoverably destroyed.

Without the key, the encrypted data is nothing but a useless random string — unrecoverable with today’s technology.

Legally robust. Data whose key has been irrecoverably destroyed no longer counts as personal data under the GDPR — the person can no longer be identified. The encrypted file may remain in the archive and is effectively erased.

A layered approach #

Crypto-shredding governs final erasure. For day-to-day exchange, further techniques come into play:

  • Anonymization & pseudonymization — before an export, identifiers can be removed irreversibly or replaced by reversible tokens. When a manager sends data to a bank for a credit check, the names of the other tenants can be anonymized while the applicant is pseudonymized.
  • Access control by design — there is no open API. Whoever wants to share data deliberately creates a purpose-bound export. This enforces a decision about which data goes to whom — uncontrolled full access is ruled out.

A standardized framework #

For the exchange between controller (manager) and processor (e.g. bank), a standardized data-processing-agreement template is foreseen: clear roles, a defined purpose and scope, mandatory technical and organizational measures (encryption, crypto-shredding, anonymization). This lowers the legal effort for everyone involved.

No substitute for legal review. This page describes the privacy concept of Prexfo. Its concrete implementation in your own operation must be clarified case-by-case with the responsible privacy and legal advisors.