KeyArqUnreadable to anyone but you. Including us.
CUSTOS™ captures every message, seals it cryptographically, and keeps the keys with you. Built for India and APAC's regulated organisations.
- content address
- sha256:8a3f19…c4e7b2
- sealed at
- 2024-08-08T16:07:56Z · 1.8 s after receipt
- from
- arjun.shah@keyarq.example
- custodian
- compliance-desk
- patterns
- pan · aadhaar
- retention until
- 2032-08-08 · SEBI intermediary records
- hold
- matter 224ee5d1 · preserved
Three things you'll notice first.
AI search. Ask the archive in a sentence.
Type the question the way you would ask a colleague. Ask the Archive turns it into a fully specified search, shows you the query it became so you can correct it, and answers with citations to sealed records. The count is exact every time, and the model runs beside the archive: nothing leaves your building.
No professional services. No consultants. No statement of work. No implementation partner.
Identity, directory sync, journaling, retention and holds: you connect them yourself. The setup assistant proposes each step, you approve it, nothing goes live until you have tested it, and the audit trail records who did what. Where other archives sell professional services, CUSTOS ships a product.
L1 AI support. Support that solves first, and files its own ticket when it can't.
Ask the L1 agent before you ask us. It reads the audit trail behind your question, explains what happened and walks you to the fix. When it cannot solve it, it raises the ticket with KeyArq support on your behalf, manages it to closure and keeps you informed. You never explain the same problem twice.
The rules the archive cannot break, not by an operator and not by us.
Nothing is acknowledged before it is sealed.
Your mail server hears "delivered" only after the message is durably stored and cryptographically sealed. No buffers, no async shortcuts: if we can't seal it, we don't accept it, and the sender retries.
invariant 2 · persist-and-seal-before-ACKThe keys stay in your hands.
Every record is enveloped under a key you hold. Even in our own cloud, plaintext never touches memory an operator can read, and no copy of your key exists anywhere we could be compelled to produce it.
invariant 3 · customer-held keysAI runs inside your walls.
Search, answers and agents run on a self-hosted model beside the archive. Archive content is never sent to an external AI service: not for search, not for a demo, not "temporarily for testing."
invariant 5 · local-only AINothing disappears quietly.
Every disposition is policy-driven, role-gated and written to a sealed, append-only audit trail. Lawful erasure is a recorded crypto-shred; restriction hides content from unauthorised roles, never from auditors or legal holds.
invariant 10 · audited dispositionAsk it in a sentence, or specify it to the field. Either way the count is exact.
The manual search exposes every indexed field, in any combination: sender, recipient, Cc/Bcc, mail flow, dates in any time zone, attachments, compliance patterns, message class, tags, holds. Ask the Archive hides all of that behind a question and shows you the query it became, so you can correct it. No search truncates; "about 10,000 results" is not a number a regulator accepts.
Freeze it the moment a matter opens. Keep it as long as the regulator says. Prove both.
Legal holds
A hold preserves the records it scopes from the moment it is placed; held data is exempt from retention expiry, and every touch (who was notified, who acknowledged, who read what) is in the trail.
Retention by regime
Start from templates for the regimes you answer to, refine to the person or the data, and set anything from one day to indefinite. Existing dates only ever move later; nothing is shortened by accident.
Productions
Court-ready output, Bates-numbered and sealed. Every production is reproducible: what went out can always be proven and re-served.
| Regime | Indicative period | Note |
|---|---|---|
| SEBI intermediary records | 5-8 years | WORM-class · purge inside the window is refused |
| RBI / KYC | up to 10 years | from account closure |
| PMLA | 5 years | post-transaction |
| Companies Act | 8 years | books and records |
| DPDP Act | purpose-bound | erasure needs a recorded legal basis; so does keeping indefinitely |
Indicative periods, sourced and marked "confirm with counsel": the product enforces what your tenant confirms; it never decides your obligations for you.
You decide. Where your archive lives, the seal, the index and the encryption are identical everywhere: only the location and who holds the keys changes.
On-premises you operate everything
Air-gapped if you need it. Your hardware, your keys, your GPU. Built for the sovereign-cloud and captive-datacentre buyer.
Hybrid storage with us · keys with you
We run storage and the ingestion edge; you run the application, the keys, the index and the metadata. Only ciphertext crosses the boundary: the address of every object is the hash of its ciphertext, so the key space leaks nothing.
Custos Cloud we operate everything
Our operations, your keys. Plaintext never touches memory an operator can read, and our on-call cannot decrypt what it hosts.
Everything the archive does, in one list.
No roadmap slide. Every line below is part of CUSTOS; the one that follows in v2 says so.
Journaled mail → MTA → sealed in under two seconds → indexed → searchable. Edits and deletes in chat sources captured as sealed events.
SAML with Microsoft Entra; roles and matter membership from your directory; maker-checker approval on privileged actions.
Phrases, Boolean, wildcards on both ends, has:pan-style predicates; every run recorded with its canonical query and grammar version.
Ask the Archive answers with citations; a sentence becomes a fully specified search you can correct; a setup assistant that walks you through SSO, directory sync and ingestion, proposing, never applying.
Ask the agent first. It tries to solve the problem; when it can't, it raises the ticket with KeyArq support on your behalf, manages it to closure and keeps you informed.
Every indexed field as a filter; person-based and data-based retention policies over the same criteria; separate retention for live and imported data.
Self-hosted speech-to-text only. PST via an off-the-shelf converter first, native later.
Each with its tradeoffs and what it cost; the ones that were wrong say so. Ask us for any of them.
Every message reconciled against its source, so you can show an auditor that what was sent is what was kept, and find the gaps before they do.
Connect everything yourself. No consultant required.
This is where professional services used to be. The setup assistant walks you through identity, directory sync, ingestion points and go-live, step by step, and nothing goes live until you've tested it. It proposes configuration; you approve it; the audit trail records who did.