Record governed encryption lifecycle defaults

2026-08-04 14:01:44 +02:00
parent 99a5fa52a5
commit 517dfb720e
1 changed files with 31 additions and 0 deletions
@@ -18,6 +18,37 @@ certification claim. Stronger claims require a named protection profile whose
 provider, clients, algorithms, backup procedure, and failure tests have passed
 the profile's conformance and security review.
 ## Approved Product Baseline
 The product decision recorded on 2026-08-04 separates module activation from
 content protection. Enabling Encryption makes its capabilities and
 administration available but never encrypts existing or new content by itself.
 - System definitions are reusable profile templates. Tenants explicitly
  activate profiles for an owner-module collection or individual object.
  Accounts and groups remain policy subjects rather than cryptographic scopes.
 - New objects inherit protection only inside an explicitly activated scope.
  Existing objects move through an explicit, checkpointed, copy-on-write
  migration with verified cutover.
 - The first production profile is managed server-envelope encryption backed by
  a KMS/HSM provider. The bundled local provider remains a bounded reference
  implementation. Tenant-held and client E2EE profiles require separate
  provider approval and conformance evidence.
 - Recovery defaults to a high-assurance, distinct-custodian 2-of-3 quorum with
  requester separation. Ordinary platform administration does not bypass the
  ceremony.
 - Horizontally scaled nodes may receive only short-lived, in-memory unwrap
  grants. They do not persist usable key material on node-local storage.
 - Disable remains blocked until every protected object is verifiably decrypted,
  migrated, exported, or destroyed. Externally opaque ciphertext must be
  resolved through its provider before the owning profile can be removed.
 After a migration has retired plaintext, reversal is another governed
 migration rather than retention of an undisclosed plaintext rollback copy.
 True E2EE is deliberately not part of the first production profile because it
 changes search, server-side processing, inspection, reporting, legal-hold
 export, and recovery guarantees.
 ## Ownership Boundary
 Encryption owns: