A report in mode FINAL is not a download but evidence: CRMS keeps it, encrypts it, stores it so it cannot be changed, and chains it so that every later change is noticed. This chapter shows which parts this evidence is made of and how they work together.
Subject area
Final documents and evidence
What a final document is, how hash chains and timestamps protect it against changes, how the seal works, where the bytes are kept, how long they stay, and how you verify all of it.
Topics in this subject area
- 1.What a final document is
A final document is a revision of its document chain: what defines the chain, what a revision records, and what happens when it is stored.
- 2.The two hash chains
Every object has its own chain, every tenant its journal: what a hash links, what the journal records, and what verification finds.
- 3.Timestamps and anchors
How CRMS anchors the journals of all tenants with an RFC 3161 timestamp, what the anchor check finds, and how you replace the timestamping key without losing old anchors.
- 4.The seal
What a seal is, which seal modes exist, which documents are sealed, and what the seal check finds.
- 5.Storage on WORM
Where the bytes of a final document are kept: encrypted in an S3 bucket with Object Lock, what CRMS checks at start, and who brings the storage.
- 6.Retention, legal hold and erasure
How long CRMS keeps a final document, how a legal hold blocks erasure, how erasure works, and which roles may do what.
- 7.Verify and read
The endpoints for final documents: read, list, verify. What the check result says, what is logged when reading, and what the chain does not prove.