Data protectionBuilt
Personal data, sealed by construction.
Identity platforms hold the most sensitive data people have. Aegis is built so that data is sealed where it rests, never travels where it is not needed, and is never seen without a record that it was.
Simulation
Runs entirely in your browser.
Logged first. Or not at all.
Step through a reveal, a reveal when the log is down, and a match made without decrypting anything.
Scenarios
The reasoning
A reviewer needs to see an applicant’s identity number. In what order does the platform do things, and why does the order matter?
- RequestThe reviewer asks for one value, for one stated purpose, on one run.
The vault
Services hold references. The vault holds values.
- Envelope encryption
- Every personal value is sealed under a data key wrapped by a managed key service. The wrapping key never leaves that service.
- Built
- Keyed blind indexes
- Each kind of identifier has its own keyed index, so records can be matched by equality without decrypting, and indexes of different kinds can never be compared. The index salts are wrapped too.
- Built
- Reveal after record
- A reveal is written to the access log before the value is released, and refused if the log cannot be written.
- Built
- Nothing on the wire
- Personal values never travel on event streams; only references and indexes do. Personal-data field names are banned from logs and traces by automated code rules.
- Built
Rights
Data-protection law, as a type.
The data-protection regime is a typed setting, not a paragraph in a policy. It decides statutory response deadlines, retention, breach-notification obligations and the words a person is shown.
- Regimes
- POPIA (South Africa), the EU GDPR, the UK GDPR and the Australian Privacy Act.
- Built
- Erasure and export
- Requests coordinated across every service that holds personal data, each service answering for its own store.
- In progress
- Consent
- A first-class record with a purpose; provider calls without a covering consent are refused.
- Built
- Holds
- Legal and evidence holds suspend deletion where the law requires records to be kept.
- Built
Audit
In progress
An audit trail that a tenant can check for itself.
Each service commits its audit record in the same transaction as the change it describes. One audit service canonicalises those records into an append-only log per tenant, built like certificate transparency, with signed checkpoints and inclusion proofs.
- Committed at the source
- A change and its audit record commit together, or neither does.
- Built
- Every vendor call
- Every attempt to call a provider leaves a forensic record, answered or not.
- Built
- Proofs you can verify
- Exported bundles carry inclusion proofs that a standalone verifier checks, without trusting Aegis.
- Built
- Sealed checkpoints
- Checkpoints signed under a managed key and anchored with trusted timestamps. The audit service refuses to start outside development until this is in place.
- In progress
Build on identity that is proven, not assumed.
Aegis is built by Protoworks and offered to partners on request. Tell us what you need to verify, issue or accept, and we will show you the platform running.