# Delete Your Data *A standing Neon Law Foundation talk on taking back your data.* We first gave a version of this at [BSides Portland in 2022](https://www.youtube.com/watch?v=rkzdIDiiaJg): everyone is discoverable, here is how to find your footprint, here is how to file removals by hand. Since then we became a licensed law firm and built the attorney-run machine that does it — the same steps, run by an attorney, engineered so the system holding your most sensitive data cannot leak it. This deck is a spine, not a script: every beat is a slide face plus presenter notes, and the code slides are exact copies of the shipped repository. Argue back. ## Intro ### Agenda You are here to argue, not to be lectured. By the end you will be able to: - **Recall** what the 2022 Delete Your Data talk asked you to do, and what was missing. - **Trace** the four moves — find, dispute, delete, prove — from awareness to shipped code. - **Read** the attorney-gate and the telemetry trust boundary in the real repository. - **Decide** whether to try it, fork it, or point someone who needs it at it. --- We frame this as an agenda because the room is the point. In 2022 this talk was a call to action; now it is a report on what we built when we took our own advice seriously. By the end you will be able to recall the original argument, trace the four moves from a slogan to shipped code, read the two invariants a security audience should care about most — attorney-gated deletion and a structural telemetry boundary — and decide whether the work earns your time. No outcome is promised; the ask is that you push on the code. ### 2022 — a map, drawn by hand The original talk made one argument: **everyone is discoverable**, you can **find what is out there** about yourself, and you can **do something about it**. It was a map and a to-do list — go look, then file removals one at a time. --- Here is the honest starting point, and the [2022 talk](https://www.youtube.com/watch?v=rkzdIDiiaJg) is on record. It was an awareness talk: your footprint is bigger than you think, the data brokers and people-search sites are indexing you, and the remedy was manual — pull your reports, find the errors, send the letters yourself. Everything true in that talk is still true. What was missing was leverage: one determined person filing disputes by hand does not scale, and the people who most need the help are the least able to spend a weekend on it. ## The data that follows you ### You have a file you never opened Data brokers, people-search sites, and tenant-screening bureaus assemble a file on you from public records and buy-and-sell feeds. It follows you into a **loan**, a **lease**, and a **hire** — and it is often wrong. --- For a security crowd this is familiar as an attack surface, but the everyday harm is quieter. A landlord runs a tenant-screening report and it carries someone else's eviction under your name; a lender pulls a consumer report with a record that should have aged off. You can lose the apartment before anyone reads your side. The file was assembled without you in the room, and the first time you learn what it says is the moment it is used against you. That asymmetry — they hold the data, you hold the consequences — is the thing the rest of this talk attacks. ### The footprint is a threat model Reducing your footprint is not vanity. A smaller footprint shrinks the surface for **doxxing**, **SIM-swap** social engineering, and **stalkerware** — and it is a right you can exercise, not just a setting you toggle. --- This is where the security framing earns its place. The same broker record that blocks a lease is the raw material for targeted social engineering: the answers to your security questions, the pattern of your addresses, the names of your relatives. Threat-modeling your own footprint means treating those records as exposure and deleting what you can. The difference from ordinary opsec is that a lot of this exposure is governed by law — the Fair Credit Reporting Act, state deletion rights — so the lever is legal as much as technical. That is the seam a law firm can work that a VPN cannot. ## From awareness to a machine ### Find, dispute, delete, prove The 2022 to-do list became four modular moves: **find** what is out there, **dispute** what is wrong, **delete** what we hold, and **prove** the record. Each is a step you can run on its own. --- The whole method fits on one slide. Find: pull your own screening and consumer reports, which you are entitled to, for free — still the first move in every matter. Dispute: put a licensed attorney on the inaccurate items. Delete: when you hand us data to do the work, you can have it deleted, under an audited gate. Prove: anchor a fingerprint of a signed letter so it is verifiable later without disclosing it. The rest of the chapter reads the two moves a security audience should scrutinize hardest — delete and the boundary around it — in the shipped code. ### Dispute — an attorney on the report Neon Law Nautilus puts a licensed attorney on the report for a flat fee. We dispute the inaccurate items with the bureau under the **Fair Credit Reporting Act**, which requires a reinvestigation within **30 days**. --- This is rights work, not credit repair, and we say so plainly: we dispute what is inaccurate and hold the bureau to the reinvestigation the law requires — not a promise that any report changes. A licensed attorney reads and signs every letter before it goes out, and the client's portal shows each letter, the attorney who signed it, and the 30-day clock we are holding the bureau to. The point for this room is that the workflow is auditable end to end: every artifact is recorded, attributed, and reviewable, which is exactly what you want from a system acting on your behalf. ### Delete — a client can only ask Deletion is not a button that erases on click. A client can *request* deletion; a **staff attorney authorizes** it, and the executed expunge writes an audit record of what was removed and who approved it. From `store/src/expunge_requests.rs`: ```rust //! A client can only *ask*: [`create`] inserts a `pending` row. A //! Owner/Admin/Staff then resolves it — [`authorize`] (after running the //! admin-gated expunge, passing the resulting audit-row id) or //! [`deny`]. The executed expunge is always category `client_request`. ``` --- Delete is the move a security audience should interrogate hardest, because "we deleted it" is the easiest claim to fake. Here the deletion is a two-party action encoded in the schema: the client's request inserts a `pending` row and erases nothing; a staff attorney must authorize it; and the authorization runs the admin-gated expunge and records an audit row correlating what was removed with who approved it. The control the client sees in the portal honestly reads "deletion requested" until that happens. Deletion you can prove beats deletion you assert. ### The trust boundary is structural The system that helps you delete your data is built not to expose it. The telemetry rule is structural, not a policy memo: **identifiers and counts, never client content.** From `mcp/src/tools` — the rule the whole codebase enforces: a `notation_id`, a service name, an outcome, a duration, and a status code may enter a span or a log. A client name, an answer body, an email address, or a document body may not. --- The second invariant is the boundary around the data while we hold it. Observability is where sensitive systems usually leak, because logging everything is the path of least resistance. Navigator inverts the default: every binary shares one telemetry seam, and the rule is that identifiers and counts cross the boundary while client content never does. The collector runs a fail-closed redaction processor, and the code keeps request bodies out of spans in the first place. For a room that has read one too many breach postmortems, this is the slide that matters: the boundary is written down, enforced, and testable, not aspirational. ## Access to justice at product scale ### Operated by the Foundation Neon Law Navigator is owned by **Shook Law PLLC**. The **Neon Law Foundation** runs cases and teaching on it under a perpetual, royalty-free license. Access to justice is the reason the product exists — attorney-run workflows, not a public software distribution program. --- The names and marks stay reserved so clients are never confused about which lawyers stand behind which software. The Foundation's job is mission cases and education, not shipping Navigator as open source. ### Prove it without disclosing it Neon Law Node records an attestation on Solana — **our wallet, your wallet, and a SHA-256 hash** of the signed letter. The letter stays private; only the fingerprint goes on-chain, so you can show it existed without revealing it. --- This is the one on-chain beat, and it stays a beat, not a theme, because a skeptical security audience is right to discount buzzwords. The useful property is narrow and real: a hash commitment lets you prove a specific signed document existed at a point in time without disclosing its contents. The letter never leaves your hands; the fingerprint is the only thing recorded, and the network fee passes through at cost. Anchoring is optional. We will keep saying "optional" and "at cost" until it stops sounding like a pitch, because for this room it should read as a design choice, not a product. ## Wrap Up ### Delete your data The ask is the same as 2022, with the machine behind it now: **go look**, then let it do the part that does not scale. Try it, read the code, and point someone who needs it at it. - **Find** — pull your own reports; it is free and it is the first move. - **Use it** — [contact the firm](/contact) for the disputes and deletion work; every engagement is quoted flat. - **Read it** — authorized staff can read the repository; file an issue where the abstractions leak. --- Here is the close, and it is a real ask. In 2022 we told you to go look; the difference now is that the part that does not scale — the disputing, the deletion, the proof — runs as reviewed, repeatable workflow instead of a weekend of manual labor. So go look yourself up, because that step is still yours and still free. Then, if a wrong report is standing between someone you know and a home, point them at the page. And if you build things, improve the product the Foundation runs on — the floor of competence rises for the next person. ### Resources Everything in this talk is public and verifiable. - **The talk, 2022** — [Delete Your Data at BSides Portland](https://www.youtube.com/watch?v=rkzdIDiiaJg). - **The service** — [contact the firm](/contact). - **The code** — [github.com/neon-law-foundation/navigator](https://github.com/neon-law-foundation/navigator). --- These are the pointers to take home. The 2022 talk is on record so you can see the before; the contact page is where an engagement starts now; and the repository is the whole private product stack, kept honest by the same tests that keep these slides honest. Read the code and hold us to it — that is how a foundation-governed toolchain stays accountable.