Move the safe deletion code to a PersistentModel

Would be nice to be able to use only PersistentModel, like with the current TimeStampModel.