Anonymization & Privacy
Privacy-minimal audit events, encrypted evidence, and controlled disclosure
Privacy and Controlled Disclosure
Tamper evidence does not require putting personal data into an immutable journal. KYA-OS keeps the signed event privacy-minimal and places sensitive detail in separately encrypted, retainable evidence.
Party references
Choose the least revealing reference that still supports the declared verification purpose:
| Reference | Use |
|---|---|
public_did | A deliberately public, resolvable identity |
pairwise_did | A relationship-specific identifier that limits correlation |
keyed_commitment | A stable, tenant-scoped commitment with an explicit key ID |
evidence_ref | An identity or resource disclosed only through controlled evidence access |
A recorder signer uses a separate SignerRef containing a resolvable DID, key ID, and algorithm. Never substitute a privacy commitment where cryptographic key resolution is required.
Data minimization rules
- Do not put raw IP addresses, authorization headers, credentials, prompts, tool inputs, tool outputs, stack traces, or personal records in the event.
- Use stable reason codes in the event and put human-readable or sensitive detail in evidence.
- Commit policy and delegation artifacts by digest; include the full artifact only when an authorized verifier needs it.
- Scope keyed commitments by tenant, purpose, and rotation key so they cannot become global tracking identifiers.
- Keep
action.categorysuitable for broad analysis; use an evidence reference for sensitive action detail. - Derive tenant authority from authenticated server context, never from an untrusted body field.
Encrypted evidence
Evidence uses A256GCM metadata and commits ciphertext digest, media type, size, nonce, key ID, and associated-data digest. Bind associated data to tenant, event identity, retention class, and evidence purpose. Verify ciphertext before append so a signed entry never promises evidence that was not durably accepted.
A digest can still be personal data
Plain, unsalted hashes of low-entropy identifiers are reversible by guessing. Use tenant-scoped keyed commitments and rotate keys according to policy.
Access and export
Access to evidence and replay bundles is purpose-bound and auditable. Emit audit.accessed and audit.exported events with a selection digest and purpose. Export inventories explicitly distinguish included, redacted, disposed, unavailable, and policy-excluded components.
Verification policy—not bundle content—defines trusted recorder epochs, observer keys, exporters, algorithms, purposes, and key-revocation semantics. This prevents a bundle from declaring itself trustworthy.
Retention, legal hold, and deletion
Assign a retention class at event creation. Apply legal holds as explicit ledger events. Dispose of ciphertext and rebuildable projections according to policy while retaining minimal signed commitments needed to prove that evidence once existed and was intentionally disposed.
Privacy requests must be resolved against applicable law and the system's declared trust model. Do not claim that an append-only journal alone guarantees compliance; minimization, encryption, purpose limitation, retention, and authorized disclosure remain separate controls.