A deleted user came back to life in a backup restore

transcript

A user asked to be deleted. You did it. Every system, verified. Three weeks later, an incident. You restore a backup.

Backups are the hardest part of deletion. You can't surgically remove one user from a backup taken months ago.

Day 0: primary systems are clean. The user goes on a pending deletion list. Day 30: daily backups and snapshots expire. Day 90: weekly backups and old S3 versions. Then every copy is gone.

But here's the catch. Your week 3 restore came from before the deletion. Every row you deleted is back. The user lives again.

So a restore never goes straight live. First, every tracked pending deletion is re-applied to it. Only then does it go live.

Which ones? Every request made after the backup. Plus the 30 days before it. Those may not have finished when it ran. Re-applying is safe. Deletes are idempotent.

Deleting from live systems isn't the end. Track who left, and replay it on every restore, until the last backup expires.

Full breakdown in the lecture.