Lion Cipher Lab
Make deleted customer data unrecoverable everywhere with per-tenant keys (crypto-shredding, built and measured)
- Cloud Security
- Advanced
- ~90 min
- Free · no account required
Why it matters
Every SaaS company eventually gets the email: a customer is leaving and wants their data deleted. Deleting rows from the live database is easy. The hard part is everything else: 35 days of nightly backups you are not allowed to edit, an analytics export someone copied into a data warehouse, log lines with customer emails in them, and the database file itself, which keeps deleted rows on disk until something overwrites them. In this lab you count those copies on your own machine: deleting acme's 40 rows leaves 234 readable copies behind. Then you build the design serious platforms use, a…
What you'll learn
- Designing per-tenant data keys wrapped by a key-encryption key (envelope encryption) for a multi-tenant SaaS
- Crypto-shredding: making every copy of a tenant's data unreadable by destroying one key instead of editing every backup
- Measuring a deletion: counting readable copies across the primary database, raw database file, backups, exports and logs
- Building a safe key-deletion procedure: 7-30 day waiting period, two distinct approvers, cancel during the window
- Finding the leaks crypto-shredding does not close: plaintext logs, decrypted exports, cached data keys, key-store backups, deleted rows in free pages
- Fixing each leak and measuring the fix, including KEK rotation to neutralise old key-store backups
- Explaining crypto-shredding against GDPR Article 17, UK ICO guidance on backups and NIST SP 800-88r2 cryptographic erase
Steps in this lab
- The problem, and the words you need
- Set up: a terminal, Python, and one package
- The code: a toy SaaS, a toy KMS, and a way to count readable copies
- Run it: what row deletion leaves behind
- Crypto-shred acme safely: two approvers, a waiting period, and a mistake caught in time
- Why it works: you only have to destroy the small thing
- Measure the five leaks crypto-shredding does NOT close
- What each fix costs (so you can choose, not just copy)
- Does this satisfy an erasure request? GDPR Article 17 and backups
- Operational risk: destroying the wrong key is forever
- Honest limits: when crypto-shredding is not enough