Questions

Can Permafrost read my data?

By default, yes, the same as S3 or Google Cloud Storage. Every upload is encrypted at rest with keys the deployment holds, so Walrus and the disk see only ciphertext, but the deployment can decrypt. The operator is in the trust path.

The public ledger records what was written and deleted witnessed, and you can check those entries weren’t changed verifiable. It can’t prove a read didn’t happen. If your threat model includes us, don’t rely on the default; take one of the two choices below.

The releases we run are recorded on the public ledger, in order, from when each starts serving. A release entry is our statement of what we run, not proof. our statement

Why is that the default?

Because the features that set Permafrost apart need it:

• Custody: delete one object, even from Walrus, by destroying its key and recording a certificate on Sui our statement. We can only destroy a key we hold.
• Receipts that match your file: a receipt fingerprints the file you sent, not a ciphertext, so anyone you give the original and its salt can check it.
• Shared spaces without key handling: a member is an address in the space’s policy. Add one with a policy write; remove one and access ends at once. Nobody hands out or rotates keys.
• Reads inside a file: range reads and streaming.

You also never manage a key, so you can’t lose one.

Can I keep Permafrost from reading?

Yes, in two steps. Mix them per bucket or per file; see Encryption choices.

	Your key service	Your encryption
Who holds the key	Your key service, on a dedicated deployment	You, before upload
When we can read	Only while serving a request you authorised	Never
Cut us off	Revoke: stored data is unreadable to the deployment at once, Walrus copies included our statement	Nothing to revoke
Custody certificates	Yes	No
Receipts	Yes, with a salted fingerprint by default	Fingerprint your ciphertext, not your original
Shared spaces	Work as by default	Access is still enforced, but members need your key from you
Range reads inside a file	Yes	Only if your format supports them
If you lose the key	Every object under it is unreadable; we can’t recover it	The same

What do I keep if I encrypt everything myself?

Placement, retention, tenancy, limits, the ledger and receipts all work on what you upload. Leaving is complete: your ciphertext on Walrus and your keys are all you need, with no part of the deployment involved.

What do I give up?

• A deletion certificate. Destroying your key makes the data unreadable for everyone, but there’s no certificate to hand a third party.
• Receipts against the original. A receipt names the ciphertext, so checking it needs the exact encrypted bytes, not the file you started from.
• Key-free sharing. Space members, the referee of an agent space included, read ciphertext unless you give them the key. When a member leaves, protecting new data means a new key, and they keep whatever they already decrypted.
• Reads inside a file, unless your format supports them.
• Recovery. Lose the key and the data is gone. We can’t help.