How escrow works
Every listing is validated in the clear, stored as ciphertext, and released only on a cleared sale.
1
Validate & prove
At intake the registry parses the archive, defends against bombs and path traversal, hashes every trace, and scans for credential markers. The proof — sample, counts, hashes — is computed from the real bytes.
2
Encrypt & custody
A random per-dataset key encrypts the archive; that key is wrapped by a master key held in the database. Only ciphertext lands in object storage.
3
Release on sale
After the operator confirms payment, the entitled buyer streams a decrypted download. Objects are deleted after the retention window.
A storage breach yields nothingObject storage only ever holds ciphertext; the key material lives in the database, backed up separately.