Etch

Custody

Who holds the signed chain determines what happens when the record is needed in a dispute. Etch's default custody posture works for the self-evidencing majority of cases: the customer holds the signed dump, external anchors prove it has not been altered, and an offline verifier reproduces the integrity check without touching Etch. Third-party custody is a distinct offering for buyers whose year-seven case involves the operator themselves being the adverse party.

Default: customer-held signed dump plus external anchors

Every Etch project can pull a signed SQLite dump of its chain via /audit-log/dump/manifest, preserve it locally, and verify it offline against pinned public keys with etch-verify. Every closed epoch is anchored to both Sigstore Rekor and Bitcoin OpenTimestamps at fixed cadence, so an outside verifier can prove the chain has not been altered since the epoch was signed. This is the shipping default; it is the right answer for the majority of use cases where the operator is motivated to preserve their own audit log for later disclosure.

What the default does NOT cover: the case where the operator is the defendant, the regulator's respondent, or the insured party in a dispute, and their voluntary production of the record cannot be relied upon. Cyber-liability policy tails commonly run five to seven years; during that tail, the record may need to survive the operator being adverse.

Third-party custody options (on request)

Three implementation directions are available depending on the buyer's compliance driver, evidence disclosure requirements, and tolerance for cryptographic vs contractual controls. All three are engagement-scoped rather than self-serve; each requires custody-agreement drafting and, for the hosted option, admin-side storage-class configuration on the Etch platform.

  1. Etch-hosted custody tier. Etch retains an immutable copy of the customer's chain that the customer cannot delete, alter, or withhold. Requires a custody agreement covering jurisdiction, disclosure obligations, and retention window. Best fit for buyers whose primary threat model is voluntary deletion or refusal to produce.
  2. Public archive integration. The signed dump is published to a public archive (IPFS with multiple pinning providers, or an equivalent content-addressed store). The archive is not under the operator's control; anyone with the manifest hash can retrieve the record regardless of the operator's cooperation. No custody agreement required with Etch; the archive itself provides the durability.
  3. Multi-party custody bond. The chain manifest is escrowed across N independent custodians with M-of-N reconstruction. No single party can withhold, and no single party being adverse defeats retrieval. Highest cryptographic strength, highest coordination cost; best fit for buyers with a specific regulator or insurance requirement naming third-party custody explicitly.

Current status

Third-party custody is engagement-scoped, not self-serve. The default (customer-held plus external anchors) ships today and is enabled on every Pilot and Enterprise project. Requests for any of the three third-party options are handled by direct conversation with the founder; the specifics of the custody agreement, disclosure conditions, and retention window are negotiated per engagement rather than published as a standing menu. Buyers with an active RFP naming third-party custody as a requirement should reach out via the Enterprise contact form.

What Etch does not claim

Etch does not currently claim to offer third-party custody as a self-serve product tier. The default custody model is honest about its scope: it works when the operator is motivated to preserve their own record, and does not work when the operator is the adverse party in a dispute. Presenting the default as solving the adverse-custodian case would misrepresent the offering. This page names both the offering and its scope so a buyer's compliance team can evaluate the fit against their actual threat model.

Public artifacts

Custody is a load-bearing property of an evidence chain; a chain whose custody model breaks under adversarial conditions is not evidence. This page names Etch's honest scope so a buyer's threat model comparison can proceed against real ground.