What we found, including when it went against us
Reproducible benchmarks, compliance analysis and audit results. Every number here comes from a script in our repo, and the negative results are published alongside the positive ones — that is the only reason the positive ones are worth anything.
Redacting a document without destroying its evidentiary value
A black box over a PDF removes the information and the proof at the same time. Once you have redacted, nobody can tell withholding from editing — unless the document was built to distinguish them.
Read- Analysis6 min
POPIA section 24 meets the archive you are not allowed to edit
South African firms hit the retention-versus-deletion conflict earlier than European ones, because sector retention periods here are often prescribed rather than chosen.
- Method6 min
Publishing your log's head hash, and why a hash chain alone isn't enough
A hash chain proves nobody edited what is in the log. It says nothing about what never made it in. Anchoring is the fix, and it fixes less than people assume.
- Method6 min
Compression is not encryption, and five other confusions worth clearing up
Six pairs of terms that get used interchangeably in procurement documents and mean entirely different things. Getting them wrong is how organisations buy the wrong guarantee.
- Analysis6 min
A proof is only as good as the thing it points at
Zero-knowledge proofs are widely described as proving facts. They prove computations. The difference is the whole reason selective disclosure has not already replaced sending documents around.
- Analysis6 min
S3 Object Lock, WORM, and what “immutable” actually buys you
Object Lock stops deletion. It does not tell you whether the content is what it was, and it binds the guarantee to one provider's control plane. Two different assurances, routinely sold as one.
- Analysis5 min
Six situations where you should not buy this
Written by the vendor. Changing a storage format has real costs that a ratio does not capture, and in these six cases the honest recommendation is to keep what you have.
- Analysis7 min
How to delete one person from an archive you promised never to change
Article 17 says erase the person. WORM storage says nothing may ever change. Both can be satisfied at once — but only by one mechanism, and it has limits worth stating plainly.
- Audit8 min
We tried to show the South African PowerBall is rigged. It isn't.
1,558 draws, four compressors and a synthetic control. The lottery passes cleanly — but our first attempt produced a dramatic false positive, and why it did is the more useful result.
- Benchmark7 min
27.3% smaller than Parquet+zstd-9 on real taxi data — and four places it loses
One million rows of public NYC taxi data, byte-for-byte lossless, queried in place. The result is good but narrow, and the cases where Parquet wins are more useful to know before you buy.
- Method6 min
A compression ratio is not a benchmark
Six questions that separate a real measurement from a number chosen to look good — written by a vendor who has been caught by four of them.
- Analysis6 min
Your audit log doesn't need a blockchain. It needs one hash and some discipline.
Blockchains solve consensus between parties who distrust each other. An internal audit log has one writer, so it needs a much cheaper structure — and one caveat almost nobody mentions.
- Analysis6 min
What a file format can and cannot do for EU AI Act Article 10
Article 10 asks for training data that is governed, documented and traceable. Exactly one of those is a property of bytes — and the other two are where the compliance-in-a-box pitches quietly fall apart.
- Analysis6 min
What a deletion certificate actually proves
Most proof-of-deletion documents are an assertion with a logo on it. Here is the difference between that and evidence, and the one limit that no certificate can engineer away.