Writing
Long-form on retention, cryptographic evidence, provable deletion, and the decisions we made building Lethra — including the trade-offs that do not flatter us. Published under the company, because the product asks to be trusted for years.
10 articles · 55 minutes of reading
Latest
Where a company is registered and where its data physically sits are separate questions with separate answers. Both of ours are deliberate, and the reasoning is the kind a compliance reviewer will ask for anyway.
·5 min read
No Kubernetes, no service mesh, no event bus, no dashboard for end users, no document management features. Each omission was a decision with a reason, and the reasons are more useful than the list.
architecture · engineering5 min
Retention rules differ by jurisdiction and change over time. Putting that behind a declared regime keeps it out of partner code, and makes the schedule an auditable artefact rather than a scattered assumption.
product · api-design5 min
One sealed envelope, one key, one lifecycle. Why the whole system is built around a single unit of retention, and what breaks in designs that pick a coarser one.
architecture · product6 min
Most compliance tooling produces evidence that stops working when the vendor does. Three verification paths, each less dependent on us than the last, and the third works with no connection to us at all.
verification · cryptography5 min
If an archive provider can read what they hold for you, the risk was duplicated rather than outsourced. No certification changes that, because the exposure is a capability rather than a policy.
threat-model · encryption5 min
The obvious version of our signing design needed around 700,000 hardware signatures a month. Batching them into a daily Merkle root brought it to roughly 100, with the customer-side guarantee unchanged.
cryptography · merkle-trees6 min
A delete call returns a status code, not evidence. Between that call and the bytes being unrecoverable sits a chain nobody outside the provider can inspect. Crypto-shredding closes the gap.
cryptography · deletion6 min
Long-term document retention is usually costed as a storage question. The storage line turns out to be a rounding error, and the four properties that actually matter are not things a bucket provides.
architecture · evidence6 min
A generation of platforms removed paperwork from the user's day. The obligations attached to that paperwork did not vanish — they landed on the platform, which was built for speed rather than for keeping things.
retention · platforms6 min