A single piece of personal data rarely lives in one place. It starts in a source database, then gets copied outward as it flows through the organization: into a marketing platform, an analytics warehouse, a support-ticket system, a backup archive, a third-party processor. An erasure request is only genuinely fulfilled when every one of those copies is deleted.
The request always reaches the source database directly. From there it can only cascade onward to a downstream system if the organization's data-lineage map actually records that the copy exists there. Untracked flows never receive the delete command — the copy silently survives, and nothing about the organization's own dashboards reveals that.
The verification scan represents an external or forensic audit: it checks every system that actually holds a copy, tracked or not. With a lineage map, the scan confirms zero remaining copies. Without one, it uncovers exactly the copies the cascade never reached — the gap between "we deleted what we know about" and true compliance.
- Lineage map toggle — switches which downstream systems the organization actually knows to reach.
- Submit erasure request — propagates the delete command along tracked links only.
- Run verification scan — reveals the ground truth across all real systems, tracked or not.