Immutable like WORM — but you can query it and erase from it.
WORM storage buys you immutability and traps you with it: the data is opaque, you can't delete a person even when the law demands it, and it's expensive per terabyte. AT-1 keeps the tamper-evidence you bought WORM for — and adds query-in-place, per-subject erasure, and compression on top.
| Tamper- evident | Queryable in place | Per-subject erasable | Compressed | |
|---|---|---|---|---|
Traditional WORM immutable and often certified, but opaque, un-erasable, and expensive per TB | ||||
AT-1 tamper-evident, queryable in place, per-subject erasable, and compressed |
What WORM costs you — and what AT-1 gives back
Opaque → queryable
WORM makes you restore the archive to read anything. AT-1 answers a query in place, reading under 1% of the file for a selective window.
Un-erasable → per-subject erasable
WORM immutability collides with the right to erasure. AT-1 destroys one subject's key in milliseconds — the record stays, the person is gone, with a signed certificate.
Tamper-evidence, kept
The reason you bought WORM: a SHA-256 manifest means a single changed byte fails verification. The archive is provably the original.
Expensive → compressed
Store the same history smaller, on ordinary object storage, instead of premium WORM media priced per terabyte.
Honest scope: AT-1 is a cryptographically tamper-evident format, not a hardware WORM appliance carrying a specific storage certification (e.g. SEC 17a-4). Where a rule mandates certified WORM media, AT-1 complements it with query, erasure and compression rather than replacing the certified-media requirement outright.
WORM-alternative questions, answered
- Why look for a WORM alternative at all?
- WORM (write-once-read-many) gives you immutability, but at a cost: the data is opaque (you restore to read it), you cannot delete an individual even when POPIA or GDPR requires it, and it is expensive per terabyte. AT-1 keeps the tamper-evidence WORM is bought for while removing those three limitations.
- How can it be immutable and still let me erase a person?
- The archive itself is append-only and tamper-evident — a SHA-256 manifest means any change to the retained records is detectable. Erasing a data subject doesn't rewrite those records; it destroys that person's encryption key, so their PII becomes permanently irrecoverable while the archive's bytes stay identical and still verify. You get immutability of the record and deletability of the person.
- Can I query it without restoring, unlike WORM?
- Yes. AT-1 supports predicate and projection queries in place — a selective window reads under 1% of the file. You answer an audit or subject-access query in milliseconds instead of restoring the whole archive first.
- Is AT-1 a certified WORM appliance (e.g. SEC 17a-4)?
- No — and we won't pretend otherwise. AT-1 is a cryptographically tamper-evident format, not a hardware WORM appliance with a regulator's storage certification. If your rule mandates certified WORM media specifically, AT-1 complements it (query + erasure + compression on top); it does not replace the certified-media requirement by itself.
Locked into WORM you can't query or erase from? Let's fix that.
Get in touch