A system includes a storage unit, a trusted time source, a key generation unit, and an encryption unit. The storage unit is configured to store data. The trusted time source provides a correct time responsive to a request. The key generation unit receives a time expiration associated with the data stored on the storage unit. The time expiration indicates when the data stored on the storage unit is to become inaccessible. The key generation unit further receives the correct time from the trusted time source and generates an encryption key based on the correct time and further based on the time expiration. The encryption unit is configured uses the encryption key to encrypt the data stored on the storage unit. A certificate that includes the time expiration and a decryption key associated with the encryption key is generated responsive to the data stored on the storage unit being encrypted.