The engineering bottleneck with assembled stacks
Records managers keep the legally meaningful PDF in one system and its metadata in another, and the two drift: the row says “signed 2023”, the file share holds three versions, none hashed. Retrieval for an audit becomes a spelunking expedition, and retention — delete after seven years, never delete under legal hold — is enforced by nobody remembering to do it.
Architecture on the Software Lifecycle Cloud
Ingest writes both sides atomically from the archivist’s point of view: object into the bucket under a stable key, row into the documents table with a SHA hash of the bytes, the signatories, and the retention label computed from document type. A worker extracts text for the search index. Deletion jobs read the same labels, skipping anything under hold, and log what they destroyed.
The hash is the trust anchor
Storing a hash at ingest turns “is this the document as signed?” into arithmetic. Any later copy can be verified against the row, and the archive can prove integrity without WORM-storage theatre. Combined with the retention label on the same row, the archive answers the two questions auditors actually ask — is it authentic, and why does it still (or no longer) exist.
- Every PDF is verifiable against the hash recorded at ingest
- Legal hold is a field checked by the deletion job, not a sticky note on a folder
- Text search runs over the archive’s own index — no documents leave the zone for an external search service
Retention as a scheduled workflow
Expiry is a recurring workflow: scan for rows past their retention date, skip held ones, delete object and row, write the destruction log. The policy discussion happens once, when the label rules are declared; afterwards enforcement is a job with a paper trail, reviewed like any other change to the project.
Frequently asked questions
By the SHA hash written to its table row at ingest. Recompute the hash of the bucket object and compare; any tampering or corruption shows immediately. The hash, parties, and dates travel together in the row.
Yes. Hold is a flag on the record, and the retention workflow checks it before every deletion. Placing or lifting a hold is a recorded change on the row, so the hold history itself is auditable.
Yes. A worker extracts text at ingest and a text index is declared over the document records, so staff search by content, party, or date range from the same project — while the PDFs themselves never leave the European zone.
Related capabilities, architectures, and comparisons
Ship your stack on the Software Lifecycle Cloud.
Closed preview on dedicated European infrastructure. Bring a repository or start from a blueprint.