Open-source, self-hosted evidence management for international courts, tribunals, and human rights investigators. Chain of custody that holds up in court.
Each custody event is hash-chained to the one before it. Seizure, analysis, seal, disclosure, redaction, court — if any link breaks, the record says so.
Drone footage, sector 4
Evidence · 00:04:12 · 218 MBWitness W-0144 testimony
Protected · pseudonymisedBanking trail
3,842 records · legal holdForensic image SM-S911
128 GB · SHA-256 verifiedLegacy e-discovery tools run on clouds your jurisdiction doesn't control. A political shift abroad should not end a war-crimes investigation in The Hague.
Self-host on any infrastructure. Zero telemetry, zero outbound calls, air-gap compatible. No vendor lock-in.
Every custody event is hash-chained. PostgreSQL RLS refuses UPDATEs and DELETEs — even from superusers.
AES-256-GCM encryption of witness PII. Defence sees pseudonyms. Duress passphrases produce decoy vaults.
AGPL-3.0. Read the code, audit the crypto, fork if you have to. Evidence survives the company.
Four phases, each cryptographically bound to the next.
Ingest
Chunked resumable uploads, client-side SHA-256, RFC 3161 timestamping. If a byte is off, the upload fails with a 409.
Seal
Append-only custody log. Each row hash-chains the previous. PostgreSQL RLS refuses UPDATEs — even from superusers.
Work
Real-time CRDT collaboration, redaction editor, witness linking, corroboration scoring — all on the sealed chain.
Export
One-click ZIP with evidence, custody log, and hash manifest. Court clerks verify with our open validator.
Written in Rust and TypeScript. Runs on your own servers, on-prem, or fully air-gapped.
Files are hashed before they leave the client. A mismatched byte rejects the upload with a 409.
Append-only at the database level. Each row hash-chains the previous; UPDATE and DELETE are refused, even for superusers.
Real-time collaboration, redaction, witness linking, and corroboration scoring on top of the sealed chain.
Transcription, text extraction, and translation run locally. Nothing leaves the box.
The VaultKeeper Evidence Exchange spec defines cryptographic evidence sharing between institutions.
A standalone tool that lets court clerks verify integrity without running VaultKeeper.
Hash-chained custody events and database-enforced append-only logs. There is no admin backdoor.
AES-256-GCM encryption of witness PII, pseudonymised views for defence, and duress passphrases that open decoy vaults.
Zero telemetry and zero outbound calls. Air-gap compatible, with AI processing kept on-prem.
Built to the Berkeley Protocol on Digital Open Source Investigations for handling digital evidence.
AGPL-3.0. Anyone can read the custody engine and verify the cryptography.
Report to [email protected]. Acknowledged within 24 hours, with a 90-day disclosure timeline.
ICC, ad-hoc tribunals, hybrid courts. Complex multi-jurisdictional cases with strict admissibility requirements.
Open-source investigators and documentation groups. Documenting violations, preserving digital evidence under hostile conditions.
Defence and prosecution handling sensitive material where chain of custody is legally critical. First-class defence counsel support.
Transitional justice bodies managing testimony archives, victim statements, and historical documentation across decades.
ZIP with evidence, custody log, and hash manifest.
Cryptographic exchange between institutions running VaultKeeper.
Independent integrity checks for clerks and defence.
Your servers, on-prem, or air-gapped.
A typical NGO is live in 15 minutes on its own server. A full tribunal migration takes six weeks.
Yes. VaultKeeper is air-gap compatible, makes no outbound calls, and runs transcription, OCR, and translation locally.
Every export includes the custody log and a hash manifest. The open clerk-validator checks integrity without needing access to VaultKeeper.
No one. The log is append-only at the database level, and each entry is hash-chained to the previous one. Row-level security refuses updates and deletes, including from superusers.
The code is AGPL-3.0. Institutions can fork it, hire a maintainer, and keep running their own instance. Evidence survives the company.
A typical NGO is live in 15 minutes on their own server. A full tribunal migration takes six weeks.