Document created
An initial version of this presentation brings together the software pages and the contract example.
This is the starting point of the history shown here.
Resources
StratoFoundry articles
Explanations of the software, its uses and how it works.
The document enters the record.
In this example, the first version of the contract is kept.
68 articles
- Technical guide
How StratoFoundry software works: the technical details
A technical guide for IT teams on S3 storage, versions, events, replication and record verification.
- Emmanuel Forgues
5 min readPressEnterprise memory must hold up when a server fails
A document evolves, an authorization expires, a decision is revised. Months later, a team needs to recover the information it relied on. KARL's Memory Layer keeps versions, links and operation traces. But this memory must also survive incidents.
- Emmanuel Forgues
5 min readS3GuardianFrom the first bug to verification at the customer site: the story of an S3Guardian delivery
From a support case to a signed pack and on-site acceptance tests: how a customer can verify an S3Guardian fix.
- Emmanuel Forgues
7 min readKARL CoreWhen project history becomes useful: KARL Core for teams
How the KARL Core memory layer links versions, approvals and decisions to help teams understand a regression and recover the context of a change.
- Emmanuel Forgues
8 min readEvidence PackEighteen months later, every byte was still where it belonged
How an investigation team turned a USB drive into a verifiable case file, and why its lawyer could prove it alone, offline, eighteen months later.
- Emmanuel Forgues
4 min readPressWhat the tech press took away from KARL's first public showing
An Australian reporter attends KARL's Ljubljana presentation and files an unsparing account: database-free architecture, a 3-second restore, and pricing still to be written.
- Emmanuel Forgues
6 min readEvidence PackOffline verification of KARL Core: proof others can check for themselves
A customer disputes a loan refusal eight months after the decision. Answering that requires proof the ombudsman can verify themselves, without having to trust the organization that produced it.
- Emmanuel Forgues
4 min readCorporate memoryWhat did we know, and when, and why did we decide that way?
Eight months after a supplier's access was extended, an internal audit asks a simple question. Answering it means recovering not today's state, but the one that existed at the moment of the decision.
- Emmanuel Forgues
4 min readReversibilityThe day switching cloud providers became possible again
A company believes it has secured its future with regular backups. The day it truly needs to switch providers, it discovers backup isn't enough: it's the memory of its data that needs to be able to travel.
- Emmanuel Forgues
7 min readGDPRAnswering GDPR rights requests without improvising
A fictional scenario shows how a DPO handles requests for access, an explanation of an automated decision, and erasure in KARL MX.
- Emmanuel Forgues
9 min readMemory LayerWhat an agent had in memory when it made a decision
A credit scenario illustrated in KARL MX shows how versioned states, the temporal graph and governed retrieval reconstruct ARIA's decision in a sealed Evidence Pack.
- Emmanuel Forgues
7 min readMemory LayerAI agent transparency: what NOA actually read
An insurance scenario illustrated in KARL MX shows how state versioning, the temporal graph and governed retrieval identify the documents and versions NOA consulted.
- Emmanuel Forgues
8 min readObject StorageObject storage solved scale. The next question is continuity.
Object storage provides capacity, configurable retention and API access. Business continuity also requires preserving data identity, context and governed history.
- Emmanuel Forgues
7 min readKARL CoreKARL Core: enterprise memory begins when the file is created
Within a supported workflow, KARL Core links data, transformations and decisions to resources from file creation and preserves their history beyond the boundaries of a Git repository.
- Emmanuel Forgues
5 min readRansomwareRestorable Does Not Mean Trustworthy
After a ransomware attack, bringing systems back online is not enough; the restored data still needs to be assessed for trustworthiness.
- Emmanuel Forgues
4 min readKARL CoreKnowing exactly what a delivery contains
A delivery package can contain several representations of the same state and their associated components. KARL Core describes them and distinguishes storage copies from a new business version.
- Emmanuel Forgues
4 min readKARL CoreA document changes its name. Its history must stay legible.
KARL Core distinguishes a resource, its location and its reference sources to preserve a drawing’s history through moves and renames.
- Emmanuel Forgues
7 min readKnowledge LayerKnowledge Layer, Memory Layer: what exactly are we talking about?
Knowledge Layer links data across sources; Memory Layer preserves their state and context over time. The article explains how the layers differ, work together and where memory begins.
- Emmanuel Forgues
4 min readGovernanceWhen S3 Storage Becomes a Governance Question
A decision made by an agent is not just its answer. You need to be able to retrieve the data, the rule, the authorization and the context that made it possible. That is the angle StorageNewsletter chose to present StratoFoundry.
- Emmanuel Forgues
8 min readPanglotOSObjects That Carry Themselves: The Origins of PanglotOS
In 1997, an engineering thesis at EPITA described distributed objects with their own usage and transformation rules, classified into three categories: white box, grey box and black box. Twenty-nine years later, the idea lives on in PanglotOS and its more than 150 polyglot services, and in the KARL core project.
- Emmanuel Forgues
10 min readKARLNIS2: compliance through immutable evidence
The NIS2 directive no longer merely requires the implementation of security measures; it mandates proof that every action has been carried out. A chain of custody based on timestamping, versioning and WORM storage becomes indispensable for essential and important entities.
- Emmanuel Forgues
18 min readNIS2Immutable architecture for NIS2 evidence: WORM, S3 and timestamped chain
The NIS2 directive requires every security action to be transformed into reliable, timestamped, and immutable evidence. Combining WORM storage, S3 Object Lock buckets, and a cryptographic chain of custody creates a comprehensive pipeline of legally admissible evidence, essential during audits or forensic investigations.
- StratoFoundry
11 min readGDPRDark data: can AI leverage archives that companies no longer know how to govern?
Organisations accumulate petabytes of so-called "dark data" every day: files, logs, emails and obsolete databases outside governance processes. This article examines their costs and risks, potential AI uses and the controls needed before use.
- Emmanuel Forgues
15 min readMicroservicesMonolith-to-microservices migration: NIS2-compliant file auditing
Legacy monoliths write their audit logs to local disk, which often results in insufficient legal traceability. Migrating these streams to S3 storage with Object Lock, versioning, and the Rust SDK enables legal immutability while reducing operational costs.
- Emmanuel Forgues
17 min readCloudDesigning audited file operations for the cloud
Organisations must not only secure data in the cloud, but prove that every file operation complies with regulations. This article explains how to build an immutable Rust audit library producing a chain of evidence suitable for auditing.
- StratoFoundry
11 min readAICyber Insurance and Artificial Intelligence: How to prove that critical data is protected and recoverable?
Insurers want evidence that critical data is protected and recoverable. This article outlines their requirements and data-protection architectures, then examines how AI can automate monitoring, optimise backup strategies and generate audit evidence. It ends with an implementation scenario for an industrial SME.
- Emmanuel Forgues
16 min readRustDeterministic Rust binaries with LTO and strip for NIS2
LTO and strip remove unnecessary symbols from Rust binaries and reduce their attack surface. A deterministic build produces the same binary from the same source code. This article explains how to configure release profiles and collect evidence for a NIS2 audit.
- Emmanuel Forgues
15 min readTokioTokio async I/O for NIS2-compliant real-time alerts
In critical environments, detecting and broadcasting an alert within microseconds supports resilience. This article describes a Tokio-based pipeline that pairs each event with an immutable chain of custody (qualified timestamp, SHA-256 hash and WORM storage) to provide auditable evidence for NIS2.
- StratoFoundry
10 min readAIIndustrial and IoT Data: Transforming Field Streams into Reliable and Legally Admissible AI Data
Industrial IoT sensors, PLCs and embedded systems generate petabytes of measurements each day. This article explains how to make these streams reliable, traceable and admissible in audits or legal proceedings. It outlines governance, quality and security practices and a reference architecture, illustrated by an industrial predictive-maintenance scenario.
- Emmanuel Forgues
16 min readcdylibCross-platform native extensions with Rust cdylib for NIS2
Rust cdylib extensions combine high performance with C-compatible portability. Paired with zeroize, SHA-256 and UUID v4, they can be used to build plugins that meet NIS2 technical and legal traceability requirements.
- Emmanuel Forgues
17 min readRansomwareRansomware defence without full reconstruction
Organisations can no longer rely solely on restoring systems from scratch after a ransomware attack. NIS2 requires evidence of every decision, action and control. This article examines how to limit damage and document compliance without reinstalling the entire infrastructure.
- Emmanuel Forgues
11 min readConformité RGPDRetention periods: should data still present in a trained model be deleted?
The GDPR sets data-retention requirements, but trained models may retain traces of the data used to train them. This article examines the legal requirements, technical and operational risks, machine-unlearning methods, and practices for balancing compliance, performance and cost.
- Emmanuel Forgues
16 min readSSASecure and traceable behavioural alerts in Rust
NIS2 requires reliable evidence of cybersecurity measures. This article describes a Rust-based SSA (Secure Behavioural Alerts) plugin and explains how timestamping, versioning and traceability preserve each alert as evidence for an audit or investigation.
- Emmanuel Forgues
15 min readZero-knowledgeZero-knowledge encryption for Rust alerting plugins
NIS2 requires irrefutable evidence of cybersecurity measures. Alerting systems must also protect the data they process. This article describes a Rust plugin using zeroize, SHA-256 and UUID v4 to create confidential payloads without exposing the encryption key.
- Emmanuel Forgues
12 min readIAEmbedded AI and edge computing: how to synchronise data produced far from the central system?
Embedded AI processes data near sensors, while central systems still need access to it. Architectures, protocols and consistency models shape edge-to-cloud synchronisation, along with the technical, regulatory and financial risks.
- Emmanuel Forgues
11 min readGDPRIs deleting a file sufficient when it persists in a vector index, a cache, and a backup?
Deleting a source file may leave copies in vector indexes, caches, and backups. Erasure processes must account for GDPR and CCPA requirements, residual risks, and operating costs.
- Emmanuel Forgues
11 min readImmutabilityFrom raw data to automated decision-making: why enterprises need a complete chain of custody
A complete chain of custody tracks, secures, and preserves data throughout its lifecycle. It supports model reliability, regulatory compliance, and operational resilience, and integrates with DevSecOps and MLOps practices.
- Emmanuel Forgues
11 min readSovereigntyHybrid multi-cloud data fabric: securing replication between European sovereign clouds and public providers
European organisations use sovereign and public cloud environments to meet data-residency requirements and benefit from economies of scale. A hybrid Data Fabric can orchestrate replication while balancing sovereignty, performance, resilience, and compliance (GDPR, NIS2).
- Emmanuel Forgues
12 min readAIConflicting documents: how to keep AI from presenting an outdated procedure as current
LLMs can return obsolete procedures or contradict the current official version. Content lifecycle management, RAG, and AI governance help keep responses up to date.
- StratoFoundry
11 min readAIOutage or compromise: how to restore an AI platform to a trusted previous state
An outage or compromise can disrupt or alter an AI platform, affecting trust and leading to significant operational costs and legal risks. A reliable recovery must preserve model integrity, training-pipeline consistency, service continuity, and regulatory compliance.
- Emmanuel Forgues
5 min readKARLMid-caps and SMEs: achieving enterprise-grade compliance without an enterprise budget
Mid-caps and SMEs face compliance requirements with smaller budgets and teams than large enterprises. The article explains how to build an auditable, traceable, and immutable documentary chain without spending hundreds of thousands of euros.
- Emmanuel Forgues
5 min readKARLAI and Prompt Traceability: Preparing for the EU AI Act
The EU AI Act progressively requires organisations to trace, document, and audit their use of AI. Prompts, models, and outputs become evidence that must be archived immutably and remain retrievable.
- Emmanuel Forgues
11 min readAIVendor lock-in: when corporate memory becomes dependent on a proprietary AI engine
With LLMs and hosted inference services, an organisation’s ability to store, retrieve, and use its informational assets depends on a proprietary AI engine. This dependence raises technical, economic, legal, and strategic concerns.
- Emmanuel Forgues
4 min readKARLImmutability and document integrity
No security policy can prevent all data corruption. Immutability keeps corruption from becoming permanent. It is the most underestimated property of modern storage architectures, and probably the most strategic.
- Emmanuel Forgues
6 min readKARLWhy Challenges covered KARL
Challenges covered KARL and the role of time in data, an issue tied to resilience, compliance, and documentary memory for businesses.
- Emmanuel Forgues
5 min readKARLDigital Sovereignty: Regaining Control of Your Data
Regulators, clients, and administrators make digital sovereignty a concrete requirement. Regaining control of data calls for clear architectural choices.
- Emmanuel Forgues
4 min readKARLNative S3: why do away with intermediate databases
Most digital vault systems rely on an intermediate database that duplicates information. This architecture increases risk and cost and limits scalability. A native S3 approach removes that extra layer.
- Emmanuel Forgues
4 min readKARLNIS2, GDPR and SEC 17a-4 compliance begins with documentary control
Modern audits rarely fail for lack of work. More often, evidence is hard to find: documents are scattered, versions conflict, history is missing, and accountability is unclear.
- Emmanuel Forgues
4 min readKARLRansomware: why recovery matters more than protection
No organisation is totally protected. The question is no longer 'will we be attacked?' but 'how long will it take us to return to a healthy state?'. Resilience is becoming the key cybersecurity metric.
- Emmanuel Forgues
11 min readAIAI forensics: what evidence should be preserved to investigate an incident involving a model?
AI is changing how organisations make decisions and creating new types of incidents involving models. Investigating them requires traces beyond those collected in conventional cybersecurity cases. This article covers the regulatory framework, evidence to preserve, acquisition and analysis methods, and technical and legal limits.
- Emmanuel Forgues
5 min readKARLTemporal storage: why backups are no longer enough
For twenty years, companies have relied on backups to protect their data. Backups address accidental loss, but not cyberattacks, ransomware, silent corruption, or current audit requirements.
- Emmanuel Forgues
11 min readCybersecurityQuantum-ready key management: preparing PKI infrastructure for quantum computers by 2026
Quantum computers capable of running Shor’s algorithm could threaten RSA and elliptic-curve cryptography. Organisations need to prepare their key-management systems (KMS) and PKIs for post-quantum cryptography ahead of 2026.
- Emmanuel Forgues
11 min readAILogging AI interactions without creating a new personal database
Logging AI interactions supports traceability and drift detection, but can create a database of personal information. Pseudonymisation, encryption and differentially private aggregation can help limit that risk while preserving useful observability.
- Emmanuel Forgues
10 min readZero-TrustZero-trust observability: combining distributed tracing with dynamic access controls in 2025
Distributed tracing can incorporate Zero-Trust controls through contextual, automated and verifiable access policies. OpenTelemetry, service meshes and engines such as OPA support this approach. A multi-cloud payment platform illustrates its measurable benefits and operational constraints.
- Emmanuel Forgues
11 min readAIContinuous deployment of AI models via GitOps: automated pipelines, compliance validation, and instant roll-back
Combining GitOps and MLOps automates AI model builds, tests and production releases while supporting traceability, regulatory compliance (RGPD, IA Act) and immediate rollback.
- Emmanuel Forgues
11 min readImmutabilityCCTV, drones and IoT: ensuring the probative value of captured data
Images from cameras, drones and IoT sensors may be used as evidence in civil or criminal proceedings. Their probative value depends on traceable provenance, integrity during storage and compliance with legal requirements.
- Emmanuel Forgues
9 min readKARLStorage and compliance: versioning, temporality and immutability
Under NIS2, proving what an organisation did depends on how data is preserved as well as what is retained. Versioning, temporal controls and immutability are central to a compliant storage strategy.
- Emmanuel Forgues
7 min readKARLSovereign AI: why training data must remain under control
NIS2 compliance requires proof of which data informed each automated decision, when it was used and whether it remained intact. Without sovereignty over training datasets, that proof becomes impossible.
- Emmanuel Forgues
11 min readAIEdge AI Governance: how to audit and control models deployed on ultra-lightweight IoT devices
Quantization, pruning and TinyML let IoT devices with a few dozen kilobytes of RAM run AI models. Governance must address their compliance, security and performance throughout the model lifecycle.
- Emmanuel Forgues
11 min readIAMergers and Acquisitions: How to prevent AI from blending the information assets of two companies
During a merger or acquisition, AI may be used to analyse, classify or migrate information assets. Mixing knowledge bases, models or metadata can put confidentiality, compliance and the strategic value of both companies at risk.
- Emmanuel Forgues
9 min readKARLThe audit trail as a source of economic truth
An audit trail can link identities and operations to the resources they consume. This helps explain storage costs, identify the activities that drive them, and define clear allocation rules.
- StratoFoundry
11 min readMachine IdentitiesMachine identities: who is accountable when an AI agent acts with administrator privileges?
AI agents with elevated rights need clear machine-identity governance. This article examines accountability when an agent causes an incident, the risks of administrator privileges, and the controls for assigning, monitoring, and auditing access.
- Emmanuel Forgues
11 min readIAGenerated prompts and responses: simple temporary data or new corporate archives?
Prompts and generated responses can contain sensitive information, operational decisions, or business knowledge. This article examines retention and the choice between short-lived records and archiving, based on compliance, resilience, and business-value requirements.
- StratoFoundry
11 min readComplianceDecommissioned system: which data should be retained for audits years later?
After an application or infrastructure is decommissioned, some data may still be needed to answer audits and meet legal, regulatory, or contractual obligations. This article outlines what to retain and how to manage it.
- Emmanuel Forgues
11 min readIAAccess control and AI: Should an AI read everything its user can access?
Generative AI is prompting organisations to rethink access control. An assistant that can search all resources available to an employee may improve productivity, but it also raises risks of data leaks, compliance issues and new attack vectors.
- StratoFoundry
11 min readAIHR data: What should never go into an internal AI system?
Not all HR data is suitable for AI-assisted recruitment, talent management or workforce planning. This article covers GDPR requirements, discrimination risks and technical threats, then identifies data to exclude from training or inference datasets and governance measures to consider.
- StratoFoundry
11 min readAIHealthcare, finance and the public sector: Why AI data needs different infrastructure
Healthcare, finance and public administration have different requirements for confidentiality, compliance and resilience. Shared infrastructure can create legal, technical and organisational risks. This article compares sector-specific constraints and discusses isolation options and hybrid architectures.
- StratoFoundry
11 min readGDPREmployee offboarding: Revoke access while preserving an audit trail
Offboarding must revoke access quickly while preserving a reliable audit trail. This article covers organisational practices, IAM tools and observability solutions for retaining a record of past contributions amid insider threats and compliance requirements.
No articles match. Try a different word or topic.
41 additional articles are available in French. Parcourir les articles français.