Choose model
Provider-managed, customer-managed/BYOS and hash-only have different duties; bind the agreed model to each object.
MOBILE-ID · TRUSTED LTANS
Data Custody
Three custody models, reread access and lifecycle data/key responsibilities.
| Model | Payload | Evidence | Renewal / responsibility |
|---|---|---|---|
| Provider-managed | Provider storage | Per service profile | Provider maintains reread and backup access under contract. |
| BYOS | Customer storage | Evidence store by agreement | Customer retains storage/key control; provider needs policy-governed access. |
| Hash-only / external reference | External to service | Digests, references and evidence | Owner retains original bytes; missing data can block hash-tree renewal. |
| Decision | Input | Result |
|---|---|---|
| Timestamp renewal | Previous evidence; tree hash remains suitable. | New archive timestamp in the applicable chain. |
| Hash-tree renewal | Original data and prior evidence under the processing model. | Rehash, new tree, new timestamp and new chain. |
Hash-Tree Renewal requires access to the archived data and prior evidence required by the applicable Evidence Record processing model.
Outcome and scope
Define custody of originals, evidence and keys to preserve durable reread capability.
Documentation scope Workflow design and integration contract; operational configuration is confirmed per environment.
| Prepare | Receive |
|---|---|
| Payload/evidence location, storage owner, reread permission, data region and backup responsibility. | Per-object custody agreement: provider-managed, customer-managed/BYOS or hash-only/external reference. |
Participants: Data owners, storage administrators, key custodians and preservation operators.
Workflow and decision points
Check reread rights
Check durable access and credential replacement. An expiring URL is not a durable reference.
Bind keys and copies
Retain residency, key revision and backup/recovery policy. Evidence and content stores may have different custodians.
Exercise reread
Exercise exact-byte retrieval and decryption rights; surface access loss before data-dependent renewal.
States, guards and authority
| Current | Guard | Actor | Next | Artifact / recovery |
|---|---|---|---|---|
| Store configuration [model] | Confirm custodian, keys and reread access | Data owner + storage | Reread available [model] | Retain exact-byte retrieval evidence; expiring URLs are not durable references. |
| Reread available [model] | Access or decryption key lost | Storage + key custodian | Access blocked [model] | Block dependent work; ciphertext retention is not recovery. |
| Store migration [model] | Reconcile bytes, rights and references | Storage migration owner | Approved cutover [model] | Keep before/after mapping; exercise reread before retiring source. |
Exceptions and controls
| Situation | Action | Boundary |
|---|---|---|
| Hash-only | The customer retains bytes and source mapping. | LTANS does not implicitly provide original content. |
| Key inaccessible | Block reread/decryption and invoke authorized recovery. | Retained ciphertext is not recovered plaintext. |
| Store migration | Reconcile bytes, rights and references before cutover. | Preserve evidence binding. |
Authorization, approval and recovery
Provider-held payload requires access controls; BYOS requires durable access. Hash-only custody does not replace the obligation to retain original data.
Expired references or destroyed keys can prevent hash-tree renewal. Test reread periodically and migrate before access is lost.
Reconciliation artifacts and acceptance
Reconcile data/evidence locations, time-bounded access, key revision and storage-access tests.
- Revoked BYOS access must be detected; dependent operations cannot report success.
- Recovery checks metadata, bytes, evidence, keys and configuration separately.
Integration and data contract
This module includes administration without a public write endpoint. Review interface scope and deployment conditions.
Technical input and references
| Element | Definition |
|---|---|
| Input | Payload/evidence location, storage owner, reread permission, data region and backup responsibility. |
| Output | Per-object custody agreement: provider-managed, customer-managed/BYOS or hash-only/external reference. |
Who owns each custody responsibility?
| Task | Provider-managed | BYOS | Hash-only |
|---|---|---|---|
| Original bytes | Provider under contract. | Customer controls storage; grants governed reread. | Customer retains them; no byte recovery from digest. |
| Evidence / metadata | Location, replicas and retrieval rights fixed in profile. | Agree content and evidence storage separately. | Keep digest, references and scoped evidence. |
| Decryption keys | Key owner and recovery process by agreement. | Customer controls keys; test rotation/recovery. | Customer retains original-data decryption dependencies. |
| Hash-tree renewal | Read exact bytes and prior evidence under the profile. | Read/decrypt grants must remain effective at execution. | Owner supplies inputs; missing inputs block the operation. |
| Transfer / exit | Export scope, reconcile replicas and authorize disposition. | Agree recipient, access changes and source retirement. | Transfer customer-held bytes with related evidence. |