I would take any database (eg Mongo, Maria, …) patch out the „delete“ queries, and run the DB in a confidential cloud like enclaive.cloud. Leveraging attestation and confidential compute, one can add a proof that the DB does not allow for erasure. Running the DB in a (kubernetes) cluster on multiple clouds would ensure the fault tolerance known from blockchain ledgers.