Asset, Data & Architecture
Confidential information, customer data, system data, and personal information are deleted, anonymized, or rendered unrecoverable when no longer required or upon authorized request.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
When data is no longer required or an authorized deletion is approved, all in-scope copies are removed, de-identified, or made unrecoverable using an appropriate method, and the company can show what happened, when, and with what result.
First SOC 2 program
Run deletion through a tracked ticket that identifies the person or customer, data categories, systems, authorization, and expected backup expiry. Have an engineer execute and verify the work, and use device-management or certified disposal for physical media.
As the company scales
Build orchestrated deletion across product stores, search indexes, analytics, support tools, and subprocessors. Record job results, alert on failed steps, reconcile completed cases, and clearly communicate delayed removal from immutable backups where that behavior is authorized and documented.
Confirm who authorized the deletion, the identity or tenant involved, what data is in scope, and whether a hold or other approved reason prevents any part of the request.
You should end up with: An approved deletion case with verified subject, scope, and exclusions.
Use current data flows and inventories to identify primary stores, replicas, files, indexes, logs, analytics, support systems, vendors, backups, and physical media.
You should end up with: A case-specific system and data-location list.
Select hard deletion, lifecycle expiry, cryptographic erasure, approved de-identification, media sanitization, or another method suitable for the storage and data category.
You should end up with: A documented method and expected completion or expiry time for each location.
Perform the approved actions in each system and notify third parties or internal owners responsible for copies outside the primary product.
You should end up with: Deletion job logs, administrative activity, disposal certificate, or third-party confirmation.
Query the relevant systems using stable identifiers, check job status and failure queues, and confirm that removed data is not available through normal product or administrative paths.
You should end up with: A verification record with queries, status, reviewer, and date.
Record any authorized residual copy, backup expiry date, access restriction, owner, and follow-up, then close only after all immediate steps are verified.
You should end up with: A completed case with residual-copy tracking and closure approval.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Shows that a specific authorized deletion was scoped across relevant systems, executed, verified, and closed with residual copies or delays explicitly tracked.
Include this context
case and subject or tenant identifier
Include this context
authorization and scope
Include this context
systems and data categories
Include this context
actions and timestamps
Include this context
verification result
Include this context
exceptions and closure approver
Weak evidence to avoid
A closed task saying data deleted without authorization, system list, job result, verification query, or backup treatment.
Confirm what the record proves
Shows that identified media, devices, or records entrusted to an internal team or disposal provider were destroyed or rendered unrecoverable by a stated method.
Include this context
certificate identifier
Include this context
asset or media identifiers
Include this context
quantity and custody owner
Include this context
disposal method
Include this context
completion date
Include this context
provider or witness
Weak evidence to avoid
A recycling receipt with no serial numbers, media count, destruction method, completion date, or link to the retired assets.
Confirm what the record proves
Shows the exact device or medium sanitized, the approved technique and tool result, and the person who verified it before reuse or disposal.
Include this context
asset and media identifier
Include this context
data classification
Include this context
sanitization method and tool
Include this context
execution date and result
Include this context
performer
Include this context
verifier and final disposition
Weak evidence to avoid
An asset status changed to wiped without a device identifier, method, tool output, performer, or verification result.
Confirm what the record proves
Shows that approved transformation removed or altered the identifiers and linkages relevant to the stated use, and that the resulting data was evaluated before being treated as de-identified.
Include this context
source data set and purpose
Include this context
fields and linkages addressed
Include this context
transformation method and execution
Include this context
resulting data location
Include this context
validation method and result
Include this context
reviewer and date
Weak evidence to avoid
A claim that names were removed while stable account IDs, free text, exact timestamps, or lookup tables still allow records to be linked back.
Type 1
The current deletion, disposal, sanitization, and de-identification procedure, named roles, and system-to-data-location mapping, together with every related case open on the examination date. If none are open, include complete dated zero-result exports from each intake, job, asset, and disposal source and a reviewer-approved reconciliation showing no unmatched case, failed job, retired asset, or pending verification.
Type 2
Every authorized customer or individual deletion, scheduled retention-expiry deletion run, system or record disposal, device or media sanitization, and approved de-identification operation performed during the review period, including failed, retried, partially completed, and canceled occurrences; plus every quarterly review due for production or customer-impacting assets and every annual review due for supporting assets, including completed no-change reviews, missed reviews, and rescheduled reviews.
Reconcile the quarterly production or customer-impacting and annual supporting-asset review schedules to dated review results, including no-change results, misses, and reschedules. Then reconcile approved privacy and customer deletion cases, retention-expiry candidates, retired assets, and disposal-provider manifests to system job logs, tickets, certificates, and verification results; investigate every missing execution, failed system step, unmatched asset, and overdue residual copy.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: When data is no longer required or an authorized deletion is approved, all in-scope copies are removed, de-identified, or made unrecoverable using an appropriate method, and the company can show what happened, when, and with what result.
Compare the documented owner with the intended role (Engineering / Infrastructure / Data Owner), then compare dated records with the stated cadence: Quarterly for production/customer-impacting; annually for supporting assets.
Reconcile the quarterly production or customer-impacting and annual supporting-asset review schedules to dated review results, including no-change results, misses, and reschedules. Then reconcile approved privacy and customer deletion cases, retention-expiry candidates, retired assets, and disposal-provider manifests to system job logs, tickets, certificates, and verification results; investigate every missing execution, failed system step, unmatched asset, and overdue residual copy.
The current deletion, disposal, sanitization, and de-identification procedure, named roles, and system-to-data-location mapping, together with every related case open on the examination date. If none are open, include complete dated zero-result exports from each intake, job, asset, and disposal source and a reviewer-approved reconciliation showing no unmatched case, failed job, retired asset, or pending verification.
Every authorized customer or individual deletion, scheduled retention-expiry deletion run, system or record disposal, device or media sanitization, and approved de-identification operation performed during the review period, including failed, retried, partially completed, and canceled occurrences; plus every quarterly review due for production or customer-impacting assets and every annual review due for supporting assets, including completed no-change reviews, missed reviews, and rescheduled reviews.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Shows that a specific authorized deletion was scoped across relevant systems, executed, verified, and closed with residual copies or delays explicitly tracked.
For each selected record, confirm it demonstrates Shows that identified media, devices, or records entrusted to an internal team or disposal provider were destroyed or rendered unrecoverable by a stated method.
For each selected record, confirm it demonstrates Shows the exact device or medium sanitized, the approved technique and tool result, and the person who verified it before reuse or disposal.
For each selected record, confirm it demonstrates Shows that approved transformation removed or altered the identifiers and linkages relevant to the stated use, and that the resulting data was evaluated before being treated as de-identified.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.