Hypothetical problem, inspired by How to query Aggregate Root to react to event from other AR How should an event sourced application handle data, where the license to that data can expire?

Example: the model includes sensitive billing information; when an account is closed, the billing information for that client needs to be scrubbed from the system.

Example: data is licensed from a 3rd party vendor; the agreement specifies that at then end of the license period, the data needs to be removed.

  • 1
    interesting problem. I guess you would have to override the system and alter the original event – Ewan Oct 24 '15 at 14:07

There is no way to delete data from an event driven system so the only way is to store the sensitive data in another data store and link to it somehow.

For example you could just store it a different table if you are using sql. Choose to store in some immutable way and just refer to it by row id. Then you are free to delete from the sensitive table.

  • But what about the situation where the data that is being tracked by event sourcing is the sensitive data? What use is event sourcing if the events don't contain the data that's changing because of the event? – Jules Oct 24 '15 at 14:20
  • That is why you just put sensitiveId:456783 which is hardly sensitive. – Esben Skov Pedersen Oct 24 '15 at 14:29
  • 1
    I believe this to be the most correct approach. It is a good idea to "isolate" yourself from 3rd party data, as you never know when their terms and conditions may change… The stored event would only contain a reference (id) to this 3rd party data. E.g BillingVendorDataReceived [vendor_name, data_id]. – gtramontina Jun 1 '16 at 14:22

How about this:

When the expiry event occurs the object is loaded via event state, but then copied or serialized to a new expired/archived object which doesn't not contain the sensitive information.

This can then be stored, either using the event sourcing pattern, but with the archive at the new first event, Or in some other non event sourcing method.


I suspect these are orthogonal concerns. Removal of data when some date expires is an aging process; either the data is removed or marked deleted by some scheduled process, or it doesn't get through the security filter (which has as one of its rules to not let through resources which have expired).

That said, if you want to look at it from an event-driven perspective, you simply add a rule to the event filter that inhibits the firing of the event if the resource has expired. Or you fire an event that puts the resource into the recycle bin instead (hypothetically speaking).

  • "you simply add a rule to the event filter that inhibits the firing of the event if the resource has expired" that doesn't make any sense. All events are stored forever in an event sourcing system. – Esben Skov Pedersen Oct 24 '15 at 14:05
  • Filtering the event during processing is likely not good enough for regulatory reasons. The event logs will have to be editable so that events with expired data can be removed. – Jules Oct 24 '15 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.