Know as little as operationally necessary
Privacy is an architectural property, not a policy promise. Customer-controlled keys, pseudonymous aliases, and salted commitments limit what any single party - including OSDF Systems - can ever learn.
Privacy by construction
Data minimization
Public infrastructure receives the least correlatable information possible. Ledgers store compact commitments, never document contents.
Pseudonymous identity
Per-document HMAC-derived issuer aliases prevent a public ledger from exposing a reusable organization identifier.
No master key
OSDF Systems never holds a universal recovery secret, bulk-decrypt endpoint, or backdoor capable of unlocking all tenants.
Private by default
Recipient identities, document titles, case numbers, and precise locations stay off public ledgers.
What OSDF Systems can see
A deliberately short list. The most sensitive material is generated and held customer-side and never transmitted in usable form.
Customer private-cloud deployments remain operable without OSDF Systems holding customer KEKs. Historical verification works offline from embedded evidence.
| Data | Default visibility |
|---|---|
| Plaintext customer documents | None |
| Customer KEKs | None |
| Plaintext DEKs | None (persistent) |
| Alias-derivation secret | None |
| Organization root private key | None |
| Public organization key | Where required |
| Document title | Not public |
| Recipient identity | Tenant-private |
| Public checkpoint | Visible |
Verifiable, private, and open
Inspect the format, run the verifier, and confirm that privacy is built into the protocol - not bolted on.