The General Data Protection Regulation (GDPR) gives people rights over their personal data. These include access, portability, correction, erasure, and consent withdrawal. For an engineering team, those rights become system behavior.

We recently reviewed Verachi’s account export and erasure paths. The main challenge was database authority. Account identity exists outside individual workspaces. Workspace membership and row-level security protect decisions, comments, conversations, and files.

Keep identity and workspace authority separate

The export now reads account records through the identity database context. It reads workspace content once per membership through the same user-scoped context as the application. The export process therefore enforces each workspace’s isolation rules.

The export contains records directly attributable to the requesting person. It excludes passwords, tokens, provider secrets, internal security evidence, other members’ data, and uploaded file bodies. Each section also has a self-service limit. Verachi rejects an oversized request instead of returning an incomplete archive.

Put erasure request concurrency in PostgreSQL

An application-level check cannot prevent two processes from creating erasure requests at the same time. Both processes can read an empty result before either inserts a row. PostgreSQL now owns that guarantee through a partial unique index. 

CREATE UNIQUE INDEX account_data_requests_active_erasure_uniq_idx
ON account_data_requests (subject_ref, type)
WHERE type = 'erasure'
  AND status IN ('requested', 'processing', 'blocked');

The application attempts the insert first. If another process has already created the request, Verachi returns that active request. Completed and failed requests stay outside the constraint, so the account can submit a later request.

Withdraw consent in the active browser session

Verachi starts with analytics disabled and loads analytics only after explicit consent. When someone withdraws consent, the page restores the disable flag immediately. It also sends an analytics_storage: denied update when the analytics library has already loaded.

The saved preference controls later visits. The runtime flag controls the page that is open now. This distinction prevents collection from continuing until the next reload.

Keep the evidence boundary visible

Erasure can require exceptions for legal obligations or legal claims. The product must distinguish deleted data from retained or anonymized records. It must also explain the result. The European Commission’s erasure guidance describes these limits.

Source, route, migration, and browser checks pass for the current change. Real PostgreSQL concurrency tests, the complete deletion worker, and production verification remain open. Until those paths pass, we cannot claim that Verachi’s full GDPR workflow is complete. The current change narrows database authority, prevents duplicate active requests, and makes consent withdrawal immediate.