Concepts
Cell and platform
Section titled “Cell and platform”A cell is a complete Reindeer deployment dedicated to one customer: its own API address, database, private IPFS network, HSM partition, keys, signing key, client certificate authority and console. No request, query or key is shared with another customer.
The platform is a separate deployment that holds no customer content. It manages organisations, signups, operators and approvals. See Platform and signup.
Record, partition and pointers
Section titled “Record, partition and pointers”A record is a JSON object: a customer record, an order, a log line, a sensor reading or a post. The copies of one id that arrive in different batches are that record’s versions. When you open an ingest session you give three JSON pointers: the record id, the owner id and the timestamp. The owner is the person, account, customer or device the record belongs to; the API calls it author, and deletion by owner uses it. Ids and owners may be strings (at most 256 bytes) or numbers. Records are grouped under a partition label (for example crm, orders, logs); reads and exports can filter by partition and day range.
Batch, chunk and key block
Section titled “Batch, chunk and key block”- Batch: one NDJSON file sent in an ingest session.
- Chunk: the immutable file that holds sealed records; every batch becomes a chunk, pinned on the private IPFS network.
- Key block: the sealed bundle with a chunk’s record keys, offsets, timestamps and owner pseudonyms. It lives in a separate store.
Epoch and roll
Section titled “Epoch and roll”An epoch is the generation of keys that wraps the key blocks. Every roll opens a new epoch and re-seals the key blocks without the keys of deleted records. The roll runs every seven days by default; the old epoch’s keys are destroyed after a seven-day safety window.
Ledger
Section titled “Ledger”The ledger is the per-tenant, append-only record of deletions. Deletion requests enter it in one transaction and get a sequence number. An erasure certificate states up to which position the ledger is erased (erased_through).
People, machines, roles and scopes
Section titled “People, machines, roles and scopes”| Kind | Sign-in | Authority |
|---|---|---|
| Person | Passkey, session token | Roles: admin, approver, auditor, reader, deleter, operator, uploader |
| Machine | Mutual TLS, 7-day certificate | Scopes: ingest:write, changes:read, records:read, exports:create, deletions:write, audit:read, status:read |
Approval and control chain
Section titled “Approval and control chain”A sensitive action creates an approval request. A second person who is not in the requester’s control chain decides it. A person is controlled by whoever requested their invite and issued its code; a machine by whoever requested it and issued its bootstrap code. See Approvals and the two-person rule.