[cozicoolmail]

Exactly - and for all intents and purposes, that should be good enough. If the data is marked "deleted" and then written over within some reasonable amount of time (whatever their VACCUM cycle is to rewrite the immutable partition) then that should be good enough.

Now as for backups, this is much harder. I don't know how reasonable it is to ask them to discard backups in cold storage - seems like a compliance nightmare that would absolutely punish smaller players that can't build infrastructure to do that.

[phn]

Regarding backups, I think the answer might be: "keep the backups only as long as you need".

Is it really reasonable for an active site to keep backups older than a couple of months? A year?