Security

If your database is stolen, prove it was worthless.

The disaster in a breach is rarely the theft itself. It is the day after: notifying every customer, the press cycle, the claims. UK GDPR Article 34(3)(a) says notification to data subjects is not required where the affected data was rendered unintelligible, for example by encryption. The hard part is proving, after the fact, that it was.

The mechanism

  • Every record is encrypted under its own unique 256-bit key (AES-256-GCM) before it touches the database. A stolen database, a stolen backup, or an exposed bucket yields ciphertext, not customer data.
  • Key material lives separately from the data it protects. Erased records have their keys zero-filled; those records are permanently unreadable, in every copy and every backup, and we issue a destruction certificate for each one.
  • The state of every record and every key event is hash-chained and anchored to Bitcoin via the OpenTimestamps protocol, so the history cannot be quietly rewritten after an incident.

The Evidence Pack

When the worst day comes, your incident team needs more than an assertion that the data was encrypted. The Breach Evidence Pack is a machine-readable, self-hashed statement generated from the ledger: which records were encrypted and how, the full key lifecycle including destruction certificates, and the Bitcoin-anchored roots that make the whole history independently verifiable with open-source tooling. It is built to be handed to your DPO, your breach counsel, your insurer, and the ICO.

What we claim, and what we do not

  • This evidence supports an Article 34(3)(a) assessment and can materially narrow the scope of notification. It does not guarantee an exemption; that judgement is case by case, and Article 33 duties to the regulator are unaffected.
  • The protection is against stolen data at rest: database dumps, stolen backups, exposed storage. An attacker operating inside your live application with valid credentials is a different problem, and we will not pretend otherwise.
  • Your documents never leave your systems. Nexum holds hashes, encrypted metadata, and proofs, so there is no honeypot of your client data to steal from us.

Early access

The Evidence Pack is live in the Nexum Ledger platform today. If you want breach evidence for your own product or firm, write to jsjjd3690@gmail.com with the subject line Breach Evidence Pack early access, and one sentence on what data you hold. We reply within two business days.

Our security posture and disclosure policy are published at /security.

Nexum Ledger Ltd, registered in England and Wales, company number 17001897. Nexum Ledger is not a law firm and does not provide legal advice; breach notification decisions remain the responsibility of the controller and its advisers.