Product
Document Vault
Chain of custody for an account's documents: each is chained to the one before by a SHA-256 digest, and the chain can be recomputed on request.
On this page
What it does
The Document Vault adds chain of custody to the account's documents. Each document saved to Document Search is given a sequence number and a SHA-256 digest that covers its own content and the digest of the document before it, so a document that is changed, removed or reordered no longer matches the chain. The account can ask the platform to recompute the whole chain at any time.
What exists now
| Capability | What it does | Where |
|---|---|---|
| Custody on save | Every document gets its sequence number, the previous digest and its own digest in the same statement that stores it, under a lock, so two saves cannot take the same place in the chain. | Documents |
| Verification | Recomputes the account's chain from the stored text and reports how many documents it covers and, if the chain does not hold, the sequence number of the first fault and its kind. | GET /account/documents/verify |
| Citation | A search result is a snippet cited to its document; the document page shows its sequence number and digest, so a citation can be matched to the custody record. | Documents |
What a verified chain establishes
It establishes that the text now held is the text that was saved, in the order it was saved. It does not establish that the text was true, who wrote it, or when it was written outside the platform. The digests are kept in the same database as the documents, so they detect accidental change and change by the runtime role; they are not an independent witness. For an independent anchor the platform's audit chain records each save.
Operating needs
- PostgreSQL with the pgcrypto extension, which computes the digests.
Limits
- It protects documents saved after it was introduced and the existing ones, which were chained in creation order when it was added.
- Deleting a document, which only the operator can do to complete an erasure request, leaves a visible gap in the sequence: verification reports it, by design.
- There is no retention schedule: documents stay until an operator deletes them.
- It is not a secrets store: nothing is encrypted by the vault, and secrets should not be saved as documents.
Availability
The Document Vault is running on RJV's own platform. RJV does not sell a licence for it as a separate product today: the commercial terms state what is on sale. It can be part of the result of an engineering engagement, where the written proposal names it, its licence terms and what you would hold at the end. To discuss it, use Work with Us.
Evidence
Chaining, locking and the detection of an altered, removed or reordered document are exercised by the platform's own database tests. The evidence register lists the graded claims.
Works with
- Audit Chain: Requires. Each document saved is entered in the account's audit chain, which is the record outside the document table.
- Document Search: Requires. The vault chains the documents that Document Search stores.
- Identity and Access: Requires. An account signs in and holds the grant that lets it keep documents.
- Evidence Register: Works with. Claims about the platform are recorded there; custody of an account's own documents is here.
Where it runs
| Supported target | A customer-controlled Linux host on x86-64 with PostgreSQL 18 (linux-x86_64-customer-controlled). |
|---|---|
| Not yet supported | Windows, macOS, phones and tablets, and Linux on other architectures. Each needs its own installation, update and recovery evidence before it is supported. |
| Check a device | Run rjv2 preflight on it. It reads the operating system, architecture, memory, disk, listen address, configuration, database, database role and schema, changes nothing, and exits non-zero if release 2.0.0-alpha.1 cannot run there. |
| Installed as | One application and a PostgreSQL database. Installing release 2.0.0-alpha.1 (schema 100) installs every system on this site, including Document Vault. |
| Data | It stays in the PostgreSQL database you run. The only outside service the release can use is an outbound mail relay that you configure. |
| Updating | A release is a numbered build. The schema is applied by a separate owner step (rjv2 migrate), and the application refuses to serve a schema it was not built for. |
| Backup and restore | rjv2 backup writes a checksummed dump. rjv2 restore restores it into an empty database and checks the checksum, the schema version and the audit chain of every account. |
| Leaving | The data is in your own database and can be dumped at any time. What you may do with the release is set by the terms on deployment and ownership. |
- Published
- 29 October 2026
- Revision
- 1