What we found, including when it went against us
Reproducible benchmarks, compliance analysis and audit results. Every number here comes from a script in our repo, and the negative results are published alongside the positive ones, that is the only reason the positive ones are worth anything.
One blanket retention period is two compliance failures at once
Most firms apply a single retention period to categories governed by different rules. That means keeping some data too long and deleting other data too early, and neither is defensible.
Read- Analysis5 min
Where table formats stop
Iceberg and Delta solved table management, and solved it well. Neither was designed to answer an auditor, and treating time travel as an audit trail is a mistake with a long fuse.
- Method5 min
“Verification failed” is not a useful answer
An integrity check that returns a boolean tells you that you have a problem somewhere in nine years of records. Locating the exact entry is the difference between an incident and an investigation.
- Analysis6 min
You could build this yourself. Here is what it would actually take.
Every component of what we sell is available to a competent team. The honest question is not whether you could build it, but whether you want to own it for the length of your retention period.
- Analysis5 min
“Which data trained this model?” is usually answered by a Slack thread
Ask an ML team which exact data produced a model in production and the honest answer is a path on a bucket that has since changed. Fixing that is cheap, and almost nobody does it before they need to.
- Analysis6 min
The backup problem nobody wants to open
Most organisations quietly exclude backups from deletion requests, on the reasoning that nobody looks at them. Regulators have been fairly clear that this is not a principle, it is a hope.
- Method7 min
The signature already sitting in your inbox
Your bank already cryptographically signs the statements it emails you. Almost nothing makes use of that, and when we built a verifier that did, we found a bug in our own implementation that a differential test caught and code review had not.
- Analysis6 min
Your evidence has an expiry date and nobody printed it on the label
A signature that cannot be validated is a certificate that has quietly stopped being evidence. For a fifteen-year obligation signed with Ed25519, that is a scheduling problem, not a hypothetical.
- Analysis5 min
Your retention period is longer than your vendor's life expectancy
Seven-year obligations routinely outlast the companies contracted to meet them. If verification requires the vendor's systems, the evidence has a commercial expiry date nobody wrote on it.
- Method6 min
Accounting for a key you destroyed
Crypto-shredding converts 'did you delete the data' into 'can you account for the key'. That is a much better question, and answering it is ordinary key management rather than cryptography.
- Method6 min
The omission problem: no cryptography detects an event that was never recorded
Every integrity guarantee in this category proves the same thing: that what is there has not changed. None of them notice what never arrived. That gap is where audit trails actually fail.
- Analysis7 min
The record has to survive. The person has to disappear. Both, provably.
A joint paper with GNCE Labs, cross-verified in both directions: an immutable governance decision record and per-subject cryptographic erasure, in one architecture. Published 20 August 2026.
- Analysis6 min
Proving one number from a bank statement without handing over the statement
A landlord needs one figure and receives twelve months of every transaction you have made. The maths to fix that has existed for years, the reason it hasn't happened is not the maths.
- Analysis9 min
A compressor read 187 constitutions and found the British Empire
With no linguistics, no training and no metadata, compression distance grouped 17 constitutions from five regions into one family. All 17 are former British territories that became independent between 1962 and 1983.
- Analysis6 min
Redacting a document without destroying its evidentiary value
A black box over a PDF removes the information and the proof at the same time. Once you have redacted, nobody can tell withholding from editing, unless the document was built to distinguish them.
- Analysis6 min
POPIA section 24 meets the archive you are not allowed to edit
South African firms hit the retention-versus-deletion conflict earlier than European ones, because sector retention periods here are often prescribed rather than chosen.
- Method6 min
Publishing your log's head hash, and why a hash chain alone isn't enough
A hash chain proves nobody edited what is in the log. It says nothing about what never made it in. Anchoring is the fix, and it fixes less than people assume.
- Method6 min
Compression is not encryption, and five other confusions worth clearing up
Six pairs of terms that get used interchangeably in procurement documents and mean entirely different things. Getting them wrong is how organisations buy the wrong guarantee.
- Analysis6 min
A proof is only as good as the thing it points at
Zero-knowledge proofs are widely described as proving facts. They prove computations. The difference is the whole reason selective disclosure has not already replaced sending documents around.
- Analysis6 min
S3 Object Lock, WORM, and what “immutable” actually buys you
Object Lock stops deletion. It does not tell you whether the content is what it was, and it binds the guarantee to one provider's control plane. Two different assurances, routinely sold as one.
- Analysis5 min
Six situations where you should not buy this
Written by the vendor. Changing a storage format has real costs that a ratio does not capture, and in these six cases the honest recommendation is to keep what you have.
- Analysis7 min
How to delete one person from an archive you promised never to change
Article 17 says erase the person. WORM storage says nothing may ever change. Both can be satisfied at once, but only by one mechanism, and it has limits worth stating plainly.
- Audit8 min
We tried to show the South African PowerBall is rigged. It isn't.
1,558 draws, four compressors and a synthetic control. The lottery passes cleanly, but our first attempt produced a dramatic false positive, and why it did is the more useful result.
- Benchmark7 min
27.3% smaller than Parquet+zstd-9 on real taxi data, and four places it loses
One million rows of public NYC taxi data, byte-for-byte lossless, queried in place. The result is good but narrow, and the cases where Parquet wins are more useful to know before you buy.
- Method6 min
A compression ratio is not a benchmark
Six questions that separate a real measurement from a number chosen to look good, written by a vendor who has been caught by four of them.
- Analysis6 min
Your audit log doesn't need a blockchain. It needs one hash and some discipline.
Blockchains solve consensus between parties who distrust each other. An internal audit log has one writer, so it needs a much cheaper structure, and one caveat almost nobody mentions.
- Analysis6 min
What a file format can and cannot do for EU AI Act Article 10
Article 10 asks for training data that is governed, documented and traceable. Exactly one of those is a property of bytes, and the other two are where the compliance-in-a-box pitches quietly fall apart.
- Analysis6 min
What a deletion certificate actually proves
Most proof-of-deletion documents are an assertion with a logo on it. Here is the difference between that and evidence, and the one limit that no certificate can engineer away.