Purpose
This procedure establishes how Maelstrom AI identifies, classifies, tracks, and protects information assets throughout their lifecycle. It applies organisation-wide, across both in-scope platforms — Provii (zero-knowledge age verification) and downpipes (no-custody backup & disaster recovery for the Cloudflare data layer).
No-custody boundary (downpipes). The downpipes engine and console run in the customer’s own Cloudflare account, under the customer’s keys; Maelstrom operates only the vendor-side control-plane and the signature-pinned update channel. The customer’s break-glass, operational and archive-signer keys — and the backup data sealed under them — are customer-held and are not Maelstrom assets. They are therefore out of scope for this register by design. Only vendor-side assets (the licence signer and the offline-held update signer) and the source repositories are tracked here.
Asset Classification
Levels
| Level | Definition | Examples | Handling |
|---|---|---|---|
| Restricted | Highest sensitivity | Signing keys, HMAC secrets | Cloudflare KV only, strict access |
| Confidential | Internal sensitive | API tokens, internal docs | Password managers, team-only access |
| Internal | Internal use | Team communications, designs | Team access, not public |
| Public | Can be disclosed | Source code, ISMS docs, APIs | Published openly, GitHub/docs site |
Asset Categories
Cryptographic Assets (Restricted):
- RedJubjub signing keys (Provii credential issuance)
- HMAC authentication secrets
- API keys for infrastructure
- downpipes Licence Signer — vendor-side key that signs licence tokens; fail-open, never gates backup or restore (control-plane)
- downpipes Update Signer — vendor-side key that signs engine update artefacts; held offline by the operator and never deployed to any Worker
downpipes backup contents are sealed under customer-held keys (break-glass, operational, archive-signer). These are generated and held by the customer, never by Maelstrom, and are not tracked as Maelstrom cryptographic assets.
Code & IP (Public / Source-available):
- Provii source code repositories (open source — per-repo AGPL-3.0-only / Apache-2.0 / MIT mix; crates dual MIT OR Apache-2.0)
- Cryptographic implementations
- SDK code
- downpipes engine, console and control-plane — source-available under the Elastic License v2 (not open source)
- downpipes offline reader — open source (MIT)
Infrastructure (Internal/Confidential):
- Cloudflare account access
- GitHub administrative access
- Configuration data
- downpipes control-plane Worker (vendor-operated; mints licence tokens, receives a content-free advisory beacon; holds no customer keys, data or Cloudflare tokens)
- downpipes update channel (
updates.downpipes.io) — vendor-operated static, signature-pinned R2 bucket; read-only; carries no customer data
The downpipes engine and console run in the customer’s own Cloudflare account (customer-operated, a complementary user-entity control); they are tracked as source repositories, not as Maelstrom-operated infrastructure assets.
Operational Data (Internal):
- Audit logs (including IP addresses)
- Analytics data
Asset Register
See Asset Register for complete inventory.
Maintained by: Security Lead Review frequency: Quarterly Updates: When assets added, changed, or retired
Asset Ownership
All assets assigned an owner (by role):
- ISMS Owner. Overall asset responsibility, signing keys
- Security Lead. Security controls, audit logs
- Developer. Code repositories, development assets
Asset Lifecycle
Acquisition
- Document in asset register
- Classify appropriately
- Assign owner
- Implement controls based on classification
Use
- Handle per classification level
- Access controls enforced
- Audit logging where appropriate
Disposal
- Follow Data Retention Policy
- Cryptographic erasure for sensitive assets
- Document disposal in asset register
Related Documents
Document Information
- Version. 1.2
- Effective Date. 2025-01-13
- Last Updated. 2026-06-19
- Owner. ISMS Owner
- Review Frequency. Annually
- Classification. Public
- Change (1.2). downpipes added as second in-scope platform; the legacy backup worker retired in favour of self-hosted downpipes. Recorded the no-custody boundary (customer-held downpipes keys are not Maelstrom assets), added vendor-side licence/update signers, control-plane and update-channel infrastructure, and Elastic License v2 source-available classification for the downpipes engine/console/control-plane.