Right to be forgotten, on top of a log that's never deleted
Destroy one key and a person's data becomes permanently unreadable, with the history left intact.
The challenge
Event sourcing makes the log the source of truth: only added to, never edited, never deleted. Privacy law says a person can demand their data be erased. Both can't be true at once. You can't delete from a permanent record, and you can't say no to the request.
How we solved it
Instead of storing personal data in the clear and trying to remove it later, we encrypt it with a key unique to each person, and keep it out of the log and the read models entirely. The log holds scrambled data, not names or birth dates. To erase someone, we destroy their key. Every record about them becomes permanently unreadable, without touching a single past event. A build-time check even fails the build if personal data ever leaks onto an outgoing event.
The result
The person is erased and the history stays intact. The two things that supposedly couldn't both be true.