-
-
Start with one question: is deleted data really gone? Pick a dataset and run the audit.
-
The whole audit in one sentence: which requests were deleted, which still have data, and which can't be confirmed.
-
"Not deleted" means real proof: each leftover copy shows the exact file, line and date it was found.
-
fix each problem, then run the checks that confirm the fix worked.
-
The evidence in plain words, with what supports it, what contradicts it and what couldn't be used kept separate.
-
For auditors, the full technical trail (rules, citations, readings) is one click away.
-
When the evidence isn't enough, TraceZero says "Can't confirm" and explains why, instead of guessing.
-
Every evidence file is read and accounted for, from database exports and logs to PDFs.
-
Every evidence file is read and accounted for, from database exports and logs to PDFs.
-
The same clear answers in dark mode.
Inspiration
Most of us have received the email: "Your personal data has been permanently deleted." But has anyone checked? A deletion confirmation usually reflects a status flag, not where the data really lives: a search index, a backup, a sync to another system. I wanted a tool that proves whether a deletion happened, using the evidence an organisation already has, and is honest when the evidence isn't enough.
What it does
TraceZero audits deletion requests against real evidence (database exports, logs, JSON, PDFs and screenshots) and gives each request a plain answer: Deleted, Data still found, Can't confirm or Not a deletion request. Every finding cites the exact file and line, with a fix and the checks to verify it. It runs as a CLI, a Python library, a local API and a web interface.
How I built it
A Python engine built in tested stages:
- Ingestion: parsers for SQL, JSON, logs, PDFs and screenshots that record where every fact came from.
- Identity: tracks a person across old emails, phones and user ids.
- Matching: requests and deletion events are matched globally as an assignment problem, where \(C_{ij}\) is the cost of pairing request \(i\) with event \(j\):
$$ \min_{x} \sum_{i,j} C_{ij} x_{ij} \quad \text{subject to} \quad \sum_{j} x_{ij} \le 1, \quad \sum_{i} x_{ij} \le 1 $$
Near-ties make it abstain instead of guessing.
- Time-aware state: only evidence captured by the audit date counts.
The React and TypeScript interface shows only what the engine returns, in plain words, with the technical proof one click away. Identical inputs give byte-identical output, backed by 347 tests.
Challenges I ran into
- Deciding what should block a "Deleted" verdict: conflicting, outdated or unclear evidence.
- Turning screenshots into structured, located facts.
- Keeping output fully deterministic.
- Security: fixing a file-leak path and DNS-rebinding exposure in the local API.
- Making engine output understandable to non-experts.
Accomplishments that I'm proud of
On a private reference dataset (518 requests, 94 evidence files), status accuracy on the 32 labelled cases is \(0.875\), with step precision \(P = 0.960\) and recall \(R = 0.860\):
$$ F_1 = \frac{2PR}{P + R} \approx 0.907 $$
Every identifier found in the evidence is accounted for, and every finding is cited.
What I learned
- Provenance has to be designed in from day one.
- "This is ambiguous" earns more trust than a confident wrong answer.
- When evidence was captured matters as much as what it says.
How I used AI
I led the project and made the decisions; Claude Code (Anthropic) did most of the implementation under my direction.
- Me: chose the problem and the approach, defined what counts as proof and when the tool must refuse to guess, set the requirements and acceptance criteria for each phase, reviewed and tested every result, decided what to keep or change (including the plain-language redesign), and ran the final verification.
- Claude Code: wrote and refactored most of the code, tests and documentation from my requirements, ran security and reliability reviews, and helped draft this write-up.
- In the product: TraceZero can optionally use cached Claude readings to help classify a request's intent. It's off by default, and normal runs make no network calls.
Credits and resources
- Libraries: pypdf, SciPy and NumPy (engine); React, Vite, TypeScript, Vitest, Testing Library and jsdom (web); used under their open-source licenses.
- Optional: RapidOCR with ONNX Runtime (screenshots); the Anthropic SDK (intent readings).
- Font: Inter by Rasmus Andersson (SIL Open Font License), via Fontsource.
- Data: the demo dataset is fictional and was made for this project. The reference dataset used for evaluation is private and not published, because it contains personal-data examples.
- License: Apache 2.0.
What's simulated or not finished
- The public demo uses fictional data; the accuracy figures come from the private reference dataset.
- No hosted demo: it runs locally by design, since results contain personal data.
- OCR and Claude caches are per dataset and not shipped.
- Single-user and local: no sign-in, saved history or built-in evidence viewer yet.
What's next for TraceZero
- Sign-in and saved history for teams
- An evidence viewer that opens each citation at the exact line
- A measured round of accuracy improvements
Log in or sign up for Devpost to join the conversation.