BurnLedger issues cryptographically verifiable deletion certificates: independent proof a person's records were present in your systems, then absent. Signed inside sealed hardware. Logged in public. Verifiable by anyone, forever.
30-day trial · no card · read-only access, always
One call snapshots the subject. We query your systems, hash the matching records in memory, and discard the raw data. Only hashes are kept.
You delete the data with your own tools, your own process. We are not in the loop. You keep full control of the erasure.
A second call re-queries your systems. Records gone? The attested enclave signs a certificate. Still present? No certificate is issued.
An Ed25519 certificate is issued and appended to a public transparency log. Anyone can verify it offline. It's math, not trust.
Regulators can require deletion — GDPR Article 17, CCPA, California's Delete Act. What they ask for next is the hard part:
A Jira ticket is a promise. An internal log is self-attestation. A screenshot is a screenshot. None of them let an auditor independently confirm the records are actually absent.
Privacy platforms like Transcend and OneTrust orchestrate the deletion workflow and mark it done on a dashboard. They don't cryptographically verify the data is gone. That's the gap BurnLedger fills.
Two API calls to create one. Zero to verify it. An Ed25519 signature is standard cryptography; any library checks it. If BurnLedger vanished tomorrow, every certificate we ever issued stays valid.
Verify a certificateIllustrative certificate — values shown are examples.
The Ed25519 signing key lives only inside an AWS Nitro Enclave. The running code is measured and attested; AWS KMS releases the key only to that exact image. A certificate proves an untampered, auditable process signed it, not that a company says so.
Each certificate is appended to an append-only Merkle transparency log (RFC 6962) with an inclusion proof. We can't deny or backdate one. Tamper-evident by construction, the same idea that keeps the web's certificate authorities honest.
Two calls around your own deletion. Read-only credentials only; we check, and reject write access.
import { BurnLedger } from "burnledger";
const bl = new BurnLedger({ apiKey: process.env.BURNLEDGER_API_KEY });
// before you delete — snapshot the subject
const att = await bl.attestations.create({
subjectIdentifier: "user@example.com",
systemIds: ["sys_pg_users", "sys_s3_uploads"],
});
// after you delete — re-verify and certify
const res = await bl.attestations.verify(att.id, {
subjectIdentifier: "user@example.com",
});
const cert = await bl.certificates.download(res.certificate.id);from burnledger import BurnLedger
bl = BurnLedger(api_key=os.environ["BURNLEDGER_API_KEY"])
# before you delete — snapshot the subject
att = bl.attestations.create(
subject_identifier="user@example.com",
system_ids=["sys_pg_users", "sys_s3_uploads"],
)
# after you delete — re-verify and certify
res = bl.attestations.verify(
att.id, subject_identifier="user@example.com"
)
cert = bl.certificates.download(res.certificate.id)Need one we don't list? We'll build it.
We never see your data. Records are hashed in connector memory and discarded on the spot. Raw data never touches our disks or logs.
We never store identifiers. Subject identifiers are salted with SHA-256 using your customer salt; the plaintext lives in memory only during a query.
Certificates outlive us. Ed25519 is standard cryptography. Any library verifies it. If we disappear, your proof still stands.
Nothing to take on faith. Attested signing, a public log, offline verification. Every claim on this page is one you can check yourself.
A single SB 362 fine runs $200 per request, per day. A month of BurnLedger is $149.
Free/ 30 days
$149/ mo
$499/ mo
Custom
One certificate, every jurisdiction. The proof is a fact — present, then absent — whichever law triggered the deletion.
Connect a database in under an hour and watch a certificate get issued.
Or email hello@burnledger.io