--- title: Extending immutability: deletion without losing data description: Tigris Object Storage implemented a Recycle Bin feature for objects and buckets on top of its immutable, geo-replicated active-active database. Unlike S3's... canonical: https://daily.dev/posts/extending-immutability-deletion-without-losing-data-oajenm5bw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Extending immutability: deletion without losing data | daily.dev og:description: Tigris Object Storage implemented a Recycle Bin feature for objects and buckets on top of its immutable, geo-replicated active-active database. Unlike S3's... og:url: https://daily.dev/posts/extending-immutability-deletion-without-losing-data-oajenm5bw og:image: https://api.daily.dev/og/posts/OAJEnm5bW.png og:image:alt: Extending immutability: deletion without losing data og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Extending immutability: deletion without losing data **[Tigris](https://daily.dev/sources/tigris)** · 10 min read · 0 upvotes · 0 comments ## Summary Tigris Object Storage implemented a Recycle Bin feature for objects and buckets on top of its immutable, geo-replicated active-active database. Unlike S3's delete markers (which expose internal implementation details), Tigris treats soft deletes as external references in a separate namespace, making recovery straightforward. The post explains the distributed systems challenges involved — particularly the anti-resurrection mechanism that prevents deleted objects from being resurrected by late-arriving writes from other regions. Soft deletion can be enabled on any bucket, keeps deleted data recoverable for up to 90 days, and is positioned as a defense against accidental deletion and ransomware attacks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Tigris implement soft delete differently from S3's delete markers? Tigris moves object or bucket metadata into a separate namespace acting as a recycle bin, storing it as an external reference (a copy of the metadata) rather than a tombstone. This differs from S3, which creates a delete marker tombstone in the same namespace. The Tigris approach makes restoring deleted objects a simple operation instead of exposing eventual-consistency internals. _Engineers weighing storage APIs against internal complexity can track design tradeoffs like this soft-delete approach on daily.dev._ ### How does Tigris prevent deleted objects from being resurrected by out-of-order writes across regions? Tigris uses an anti-resurrection rule where any write to an object must prove it is newer than a prior deletion, based on Unix nanosecond timestamps. For example, if a DeleteObject request at time 25 reaches one datacenter while a PutObject at time 15 reaches another, the older put is rejected and the delete is propagated back, keeping regions consistent. _Teams debugging active-active replication conflicts can follow patterns like anti-resurrection rules on daily.dev._ ### How long are soft-deleted objects recoverable in Tigris object storage? Soft-deleted objects and buckets remain recoverable for up to 90 days once soft delete is enabled on a bucket. Soft delete can be turned on for any new or existing bucket via the dashboard, and restoring an entire bucket is a single API call, while bucket forking (for full isolation) must be enabled before bucket creation. _Developers planning backup and ransomware recovery strategies can compare object storage retention options on daily.dev._ ## Similar posts on daily.dev - [Introducing Soft Delete for Tigris Buckets and Objects](https://daily.dev/posts/introducing-soft-delete-for-tigris-buckets-and-objects-sll6gohug) · Tigris · 4 upvotes · 0 comments - [How Bucket Forking Brings GitHub-Style Forking To Object Storage](https://daily.dev/posts/how-bucket-forking-brings-github-style-forking-to-object-storage-perbev2qb) · The New Stack · 0 upvotes · 0 comments - [Immutable by Design: The Deep Tech Behind Tigris Bucket Forking](https://daily.dev/posts/immutable-by-design-the-deep-tech-behind-tigris-bucket-forking-trkgo78e3) · Tigris · 1 upvotes · 0 comments - [Implementing Soft Deletes in Java](https://daily.dev/posts/implementing-soft-deletes-in-java-6jgaa5uhu) · Foojay.io · 1 upvotes · 0 comments - [Hunting orphan objects: 45% off our ClickHouse storage bill \(and a near data-loss incident\)](https://daily.dev/posts/hunting-orphan-objects-45-off-our-clickhouse-storage-bill-and-a-near-data-loss-incident--o5hspecqd) · Tinybird · 4 upvotes · 1 comments --- Tags: [#distributed-systems](https://daily.dev/tags/distributed-systems) [View this post on daily.dev](https://daily.dev/posts/extending-immutability-deletion-without-losing-data-oajenm5bw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Extending immutability: deletion without losing data","url":"https://daily.dev/posts/extending-immutability-deletion-without-losing-data-oajenm5bw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/extending-immutability-deletion-without-losing-data-oajenm5bw"},"datePublished":"2026-08-11T18:47:04.026Z","dateModified":"2026-09-14T07:05:03.916Z","description":"Tigris Object Storage implemented a Recycle Bin feature for objects and buckets on top of its immutable, geo-replicated active-active database. Unlike S3's...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/64fa1570ff5baf4299d740cc81cb8816?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/64fa1570ff5baf4299d740cc81cb8816?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Tigris","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Tigris","logo":"https://media.daily.dev/image/upload/s--A5ku_6TS--/f_auto/v1716186679/logos/tigris","url":"https://daily.dev/sources/tigris"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/extending-immutability-deletion-without-losing-data-oajenm5bw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"distributed-systems","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tigris","item":"https://daily.dev/sources/tigris"},{"@type":"ListItem","position":3,"name":"Extending immutability: deletion without losing data"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/extending-immutability-deletion-without-losing-data-oajenm5bw#faq","mainEntity":[{"@type":"Question","name":"How does Tigris implement soft delete differently from S3's delete markers?","acceptedAnswer":{"@type":"Answer","text":"Tigris moves object or bucket metadata into a separate namespace acting as a recycle bin, storing it as an external reference (a copy of the metadata) rather than a tombstone. This differs from S3, which creates a delete marker tombstone in the same namespace. The Tigris approach makes restoring deleted objects a simple operation instead of exposing eventual-consistency internals. Engineers weighing storage APIs against internal complexity can track design tradeoffs like this soft-delete approach on daily.dev."}},{"@type":"Question","name":"How does Tigris prevent deleted objects from being resurrected by out-of-order writes across regions?","acceptedAnswer":{"@type":"Answer","text":"Tigris uses an anti-resurrection rule where any write to an object must prove it is newer than a prior deletion, based on Unix nanosecond timestamps. For example, if a DeleteObject request at time 25 reaches one datacenter while a PutObject at time 15 reaches another, the older put is rejected and the delete is propagated back, keeping regions consistent. Teams debugging active-active replication conflicts can follow patterns like anti-resurrection rules on daily.dev."}},{"@type":"Question","name":"How long are soft-deleted objects recoverable in Tigris object storage?","acceptedAnswer":{"@type":"Answer","text":"Soft-deleted objects and buckets remain recoverable for up to 90 days once soft delete is enabled on a bucket. Soft delete can be turned on for any new or existing bucket via the dashboard, and restoring an entire bucket is a single API call, while bucket forking (for full isolation) must be enabled before bucket creation. Developers planning backup and ransomware recovery strategies can compare object storage retention options on daily.dev."}}]} ```