1. Append-only, always
An artifact is never edited. A newer report supersedes an older one and both stay readable, because an audit will eventually ask what you knew in March and an overwritten file cannot answer.
2. Access is scoped to the review
Reading an artifact requires an open review that references it. There is no browse-the-vault permission, which means a leaked account cannot enumerate every vendor’s penetration test — it can only see what its own reviews already touched.
3. The retention clock
Every artifact carries an expiry derived from the document itself: a Type II report expires with its observation window, a certificate with its validity date. When it lapses, the controls it covered re-open automatically, and the vendor’s next fetch is scheduled without anyone filing a ticket.
4. What it costs
Immutability plus per-review scoping means more objects and more index entries than a plain document store. At 41,000 artifacts that trade is not close: the storage is cheap, and the question “who could have read this, and when” has an exact answer.
About David Kross
David is the lead security architect at Urengi, where he owns the evidence extraction pipeline. He writes about parsing untrusted documents at scale and the SLAs that make an automated control defensible in front of an auditor.
