Beyond Deletion Protection: A Recoverability-Tiered Defense Against Accidental and Adversarial Data Loss in Public Cloud

Abstract

All public clouds offer deletion protection, yet data still vanishes: a cleanup job removes a bucket, a schema is dropped in a migration, a shared file system is deleted along with the training corpus it held. The mechanics vary, but the vendor checkbox does not stop them. This paper argues that deletion protection is not a property but a setting, and that recoverability is the property that actually survives contact with real operations. A tiered defense is proposed in which every persistent resource is classified by its demonstrated ability to be brought back — versioned, soft-deleted within a window, restorable from backup only, or unrecoverable — with prevention, detection, and recovery controls assigned according to tier and blast radius. The threat model spans three actor classes: accidental loss from human/automation error, autonomous-agent error at machine speed, and adversarial destruction by ransomware or an insider with stolen credentials. Because an adversary with primary-plane admin credentials can unwind ordinary configuration protections, every resource is graded twice — once for accident, once for compromise — and the gap between the two grades is precisely what retention locks, backup-plane isolation, and verified restores are built to close. The discipline reduces to one sentence: a backup that has never been test-restored is an assumption, not a control.