The record has to survive. The person has to disappear. Both, provably.

A regulated organisation is told two things at once. Keep a tamper-evident record of what you did — SOC 2, ISO 27001, sector supervision. And erase this person on request — POPIA section 14, GDPR article 17. Most architectures quietly pick one. This paper, written jointly with GNCE Labs, is an attempt to satisfy both and show the working.

It publishes today, 20 August 2026, and it is a joint document in the real sense: GNCE wrote their half, we wrote ours, and each half was verified by the other rather than taken on trust.

Read the paper (PDF, 37 pages)

The separation that makes both possible

The trick is not to store the two things in the same place. GNCE's ledger records what was decided— the verdict, the constitutional articles applied, a hash of the payload, a timestamp. It never stores the personal data. AT-1 holds the payload in a per-subject erasable archive. When erasure is required we destroy that subject's key and return a certificate proving the archive was otherwise untouched, and GNCE seals that certificate onto its hash chain as a witness.

The audit trail continues. The person disappears. The ledger records both facts.

The finding worth carrying away

The erasure obligation follows persisted content, not whether the action proceeded.

One of the four scenarios is a healthcare PHI request under HIPAA and the CLOUD Act where the governance layer returns DENY and vetoes execution. The action was constitutionally blocked — and erasure still had to complete, cleanly, with a valid certificate.

That is not a quirk of the test. If a request was evaluated and its payload was written to an operational store before the veto landed, personal data exists. A blocked action that touched personal data still creates an erasure obligation, and an architecture that ties deletion to "did we approve it?" will miss exactly those cases. For healthcare and banking, where refused requests routinely carry real identifiers, that is the difference between a compliant system and one that looks compliant.

The control case is the fourth scenario, and it matters as much: when the payload never left memory, the system declares NO_ERASURE_OBLIGATION and produces no archive, no certificate and no witness. Nothing to erase, stated explicitly rather than silently assumed.

Why we deliberately cannot sign our own homework

AT-1 returns an unsignedcertificate. GNCE's DPO signs those bytes locally, with a private key that never enters our custody. We supply the mechanism — erasable storage and the certificate format — and we do not co-sign governance decisions.

This is not modesty. A vendor that can sign attestations about its own erasure has produced a claim you have to trust rather than one you can check. Structurally separating the two makes the resulting certificate worth something to a supervisor, which is the entire objective.

What is in the paper

• The four synthetic scenarios — UAE healthcare consent, South African fintech cross-border, healthcare PHI under HIPAA and the CLOUD Act, and an in-memory banking check — with the governance verdict and erasure result for each.
• A fifth run against a hosted staging deployment, showing the same story on a production-shaped asynchronous path rather than only in a bundle.
• The erasure obligation lifecycle as explicit states: NO_ERASURE_OBLIGATION, ERASURE_PENDING, ERASURE_WITNESSED — a terminal state that is earned, not asserted.
• The canonical JSON contract, the trust model, and the threat model for each half.
• Instructions for reproducing the whole integration, including the regression gate.

Our half, in one line

Destroying a key is constant-time regardless of archive size, the archive hash before and after an erasure are identical, and the certificate can be verified by a short standalone program using nothing but Ed25519 and SHA-256 — no AT-1 software, indefinitely. You can run the same flow yourself in about fifteen minutes on the erasure demo, or read how the mechanism works in the erasure documentation.

Thanks to Valentine Nsukuzonke at GNCE Labs, who re-ran our verification independently rather than accepting our results, and who took every correction we raised about his half of the document in the weeks before publication. That is the only reason a joint paper is worth more than two separate ones.