One archive that is compressed, queryable, tamper-evident, and erasable — all at once.

Nobody else does all four

We're not the smallest file on this table — Parquet edges us on raw ratio. We're the only one that is also tamper-evident and per-subject erasable, in the same artifact you query.

Benchmarked, honestly, on 1,000,000 transactions

Honest scope: the query advantage applies to selective queries over clustered columns (it reads only the blocks a predicate touches); a random-column full scan reads everything, same as anyone. Per-subject encryption adds storage overhead, which is why we trail Parquet on raw ratio. That overhead is fixed per data-subject, so the storage win shows up when analytic columns outweigh PII— transaction, event and telemetry data with many rows per person (validated on real public payroll: the analytic part compressed 13.7×, while a thin mostly-names table is the wrong shape and barely beats raw). Build throughput is the current frontier we're widening. Cryptographic erasure (“crypto-shredding”) is an established, regulator-recognised method — our contribution is the unified, queryable, productised archive, not a new cryptographic claim.

One command surface

at1 regulated build txns.json --subject-field user_id --pii email,card_last4 --out arc/
at1 regulated query  arc/ --where amount_cents:240000:250000 --select amount_cents
                                        # queries the compressed bundle in place
at1 regulated verify arc/               # -> integrity: PASS
at1 regulated read   arc/ 1337          # -> subject 1337's PII
at1 regulated erase  arc/ 1337 --signing-key issuer.key --out-cert cert.json
                                        # PII destroyed; analytic rows still query; bytes unchanged
at1 regulated verify arc/               # -> still PASS (manifest re-sealed)

Who this is for

• DPOs & Legal — close the backup-erasure gap while keeping analytics on retained data.
• Fintech & payments — query transaction history in place, erase a customer, prove WORM integrity for audit.
• Healthcare & adtech — keep pseudonymous analytics correct after a subject is forgotten.
• Long-retention archives — years of snapshots that must stay queryable, provable, and erasable.

Compliance questions, answered

How do you prove personal data was actually deleted for POPIA or GDPR?

On every erasure AT-1 emits a signed proof-of-deletion certificate — subject ID, timestamp, a key-destruction proof, and the archive hash before and after (identical). It is admissible evidence to a regulator that the specific record is permanently irrecoverable, not merely that a deletion was requested.

Can you erase one person's data from a compressed backup or archive without restoring the whole thing?

Yes. Each data subject's PII is encrypted under its own per-subject key; an erasure destroys that one key in milliseconds. Nothing is decompressed or rewritten, the archive bytes never move, and every other record stays intact and queryable.

Is cryptographic erasure (crypto-shredding) accepted for GDPR Article 17 and POPIA section 14?

Crypto-shredding — rendering data permanently irrecoverable by destroying its key — is an established, regulator-recognised erasure method. It is also the only one compatible with a tamper-evident archive: physically excising bytes would break the very integrity proof a regulator also wants. Our contribution is the unified queryable archive, not a new cryptographic claim.

Can you query the archive without decompressing or restoring it first?

Yes — predicate and projection pushdown return exact original rows in place. A selective window over a clustered column reads under 1% of the file, about 8.5× faster than restore-then-scan at a million rows.

How do you prove the archive itself has not been tampered with?

A SHA-256 manifest binds the analytic and PII parts. Change a single byte anywhere and verification fails — so the archive is provably the original, or provably not.