It's just a soft delete behind the scenes usually (a flag in a table as you say)

They usually store some history in a logging database that can be reverted at some point in time

Nothing is really truly hard deleted on the web most times