In order to safeguard a sensitive database, we must ensure both its privacy and its longevity. However, privacy and longevity tend to be competing objectives. We show how to design a system that provides both good privacy and good longevity simultaneously. Systems are modelled as compositions of two basic operators, Copy and Split. We propose metrics with which to evaluate the privacy, longevity and performance offered by such systems. The search for the "best" system under these metrics is then formulated as a constrained optimization problem. Solving the optimization problem exactly turns out to be intractable, so we propose techniques for efficiently finding an approximate solution.