Certificates of Erasure

A Certificate of Erasure is verifiable proof that you erased - or are lawfully holding - a user's data. It's built from the audit chain, so it carries the status, the legal basis, and whether the chain still verifies.

Issue a certificate

from dpdpstack import issue_certificate

cert = issue_certificate(engine.audit, "user_42", "kyc")
cert.status           # "erased" | "deferred" | "not_found"
cert.legal_basis      # e.g. "RBI KYC Master Direction (5 years)"
cert.chain_verified   # True if the audit chain is intact

issue_certificate finds the latest erasure event for the subject (optionally filtered by purpose). If there's none, status is "not_found".

Sign it (RS256, the crypto extra)

The certificate is tamper-evident on its own, but a signature lets anyone verify it against your public key - and proves you can't forge it.

from dpdpstack import issue_certificate
from dpdpstack.signing import generate_keypair, issue_signed_certificate, verify_certificate

private_pem, public_pem = generate_keypair()   # keep private secret; publish public

cert = issue_certificate(engine.audit, "user_42", "marketing")
token = issue_signed_certificate(cert, private_pem)   # compact JWT

verify_certificate(token, public_pem)   # -> {"valid": True, ...}

Verify from the CLI

With the crypto extra, an auditor can verify a certificate from the shell - no code, just the token and your public key.

dpdpstack keygen --out-dir ./keys                       # one-time: make a keypair
dpdpstack verify cert.jwt --public-key ./keys/cert_public.pem
# VALID - signature verified.
#   subject: user_42 · status: erased (delete) · chain ok: True

Independent, counter-signed proof

Self-signing proves the certificate wasn't altered, but the issuer still holds the key. The hosted platform adds the missing half: push your audit chain to getdpdp.net, which verifies the chain, server-timestamps it, and counter-signs the certificate with its own key. That turns "JSON your company wrote" into "proof a third party attests to" - which you cannot self-fabricate, and a regulator can verify at getdpdp.net/verify.