roxanne_ardary/nullifyAutomated, policy-driven data retention and deletion system with immutable audit trails, RBAC/ABAC, multi-jurisdiction compliance, and AI/ML classification for sensitive data.
Secure. Transparent. Nullified.
Nullify is an open source, modular data retention, deletion, and lifecycle governance platform. It provides a centralized framework for discovering data, evaluating retention policies, executing controlled lifecycle actions, and maintaining verifiable audit records across distributed data environments.
Nullify is designed around a specification-first architecture. Core modules provide the foundational capabilities required for data lifecycle governance, while optional plugin modules extend Nullify with additional connectors, compliance frameworks, intelligence, integrations, storage systems, and deployment capabilities.
Nullify defines an open source architecture for centralized data lifecycle management.
The specification is built around several principles:
Nullify does not require organizations to migrate their data into a proprietary centralized repository. Instead, the system coordinates lifecycle policies and actions across existing data environments.
Nullify is divided into two primary architectural layers:
Core modules contain the foundational functionality required to operate Nullify. Optional plugins provide specialized functionality without making the base platform dependent on a particular database, cloud provider, compliance framework, AI system, notification platform, or infrastructure environment.
The primary lifecycle flow is:
Discovery → Classification → Policy Evaluation → Approval → Scheduling → Execution → Verification → Audit
Each stage is represented by an independently maintainable core module.
The Data Discovery Module identifies and inventories data resources managed by Nullify.
Features include:
The module provides the inventory required by downstream lifecycle policies without requiring the underlying data to be copied into Nullify.
The Data Classification Module assigns structured metadata to discovered resources.
Features include:
Classification results become inputs to the policy evaluation process.
The Policy Engine is the central decision-making component of Nullify.
Features include:
Policies should be declarative and machine-readable.
Nullify should support multiple policy formats while maintaining a normalized internal policy model.
The Lifecycle Decision Module converts policy evaluations into explicit lifecycle decisions.
Supported decisions include:
Every decision should contain sufficient metadata to explain:
Nullify should not assume that every destructive operation can be fully automated.
The Approval Module provides controlled human oversight.
Features include:
Organizations can configure which actions require human approval and which may execute automatically.
The Scheduling Module manages when lifecycle actions occur.
Features include:
Scheduling should separate the decision to perform an action from the actual execution of that action.
The Action Execution Module performs approved lifecycle operations against registered data sources.
Supported lifecycle actions include:
Features include:
Destructive actions should require explicit authorization according to configured policy.
The Verification Module confirms whether lifecycle actions were successfully completed.
Features include:
Verification should distinguish between:
The Audit and Evidence Module records the complete lifecycle of every important system action.
Features include:
Audit records should make it possible to reconstruct why a lifecycle decision occurred and what happened afterward.
The Data Lineage Module tracks relationships between data resources.
Features include:
Lineage allows Nullify to identify related resources that may also require retention, archival, anonymization, or deletion.
The Access Control Module protects administrative and lifecycle operations.
Features include:
