Forget the person. Keep the record.
A sealed medical archive: 3,000 patients, 17,933 claims. One patient asks to be deleted. Watch what happens to her — and what happens to everyone else.
What you just watched
Six commands. The archive was sealed and verified. It was queried without being unpacked. One patient's records were read, then she was deleted — and the deletion produced a certificate rather than a promise.
Her data is still physically sitting in the file. It is meaningless, because the key it was locked with no longer exists. The patient stored next to her reads normally. Nobody restored a backup, nobody rewrote the archive, and the whole operation took a fraction of a second.
Why the certificate matters more than the deletion
Anyone can claim they deleted something. This is a signed document naming the subject, the time, and cryptographic proof the key was destroyed — checkable by a regulator or an auditor using free public tools, with none of our software and no relationship with us.
Why the file got smaller too
5.6 MB of raw records became 1.23 MB sealed. That is a side effect, not the point — but it means the compliant version of the archive costs less to keep than the non-compliant one you have now.
The retention obligation is untouched
The clinical columns — amounts, dates, codes — stay in place and stay queryable. You keep what the auditor requires. You lose only the person's identity, which is the part the privacy regulator asked you to remove.
And it is tamper-evident
Change a single byte anywhere in the archive and verification fails. That is the same property 21 CFR Part 11 asks for in clinical records, and it holds across the deletion.
Every line in this replay is real output from @tinyfiles/cli@0.1.82, captured on 11 August 2026. The data is synthetic and labelled as synthetic — no real patient data was used. Timings are compressed for viewing; the operations themselves were faster than shown. Cryptographic erasure works on data encrypted under a per-subject key. It cannot recover or remove plaintext already sitting in an old backup, and no product can.