Audience asks: if GDPR is solved by encrypting PII inside events and deleting the key, how do backups of those events still respect deletion? Krzywda doesn't remember the exact setup but says personal data is either kept out of backups or stored separately, and only PII fields inside events are encrypted — the rest of the event remains intact. Links to the rails_event_store GDPR docs.