Purpose
This asset register identifies and tracks all information assets within the ISMS scope, documenting ownership, classification, and protection requirements.
Last Updated: 2026-04-13
Owner: ISMS Owner
Review Frequency: Quarterly
Cryptographic Assets (Restricted)
| Asset ID | Asset Name | Description | Owner | Location | Classification |
|---|
| CRYPTO-001 | Production Signing Keys | RedJubjub keys for credential issuance | ISMS Owner | Cloudflare KV (IS_KEYS) | Restricted |
| CRYPTO-002 | Production Verification Keys | Public keys for proof verification | Cryptography Specialist | JWKS (CDN) | Public |
| CRYPTO-003 | Shared Sandbox Issuer Identity | Multi-tenant shared issuer identity used by the docs sandbox gateway and sandbox wallet fleet (test keys for dev/sandbox). Quarterly rotation cadence. Compromise response: KV-sweep all docs-sbx-* keys in SANDBOX_DOCS_ISSUERS and all mwallet-sbx-* keys in SANDBOX_MOBILE_ISSUERS. 90-day audit retention for associated access events. | Cryptography Specialist | Cloudflare KV (sandbox env) | Internal |
| CRYPTO-004 | Proving Parameters | Groth16 circuit parameters | Cryptography Specialist | Git repository, CDN | Public |
| CRYPTO-005 | HMAC Secrets | API authentication secrets | Cryptography Specialist | Cloudflare KV | Restricted |
| CRYPTO-006 | DOCS_SESSION_HMAC_KEY | HMAC-SHA-256 key that signs the __Host-docs_session cookie issued by the docs sandbox gateway. Uses a kid prefix for rolling rotation on a 90-day cadence; both old and new keys retained for the full 4-hour session hard-cap window. Single-shot kid-keyed lookup, never try-both-keys. 90-day audit retention for key-use events. | Cryptography Specialist | Cloudflare Secrets Store (internal identifier redacted) | Restricted |
| CRYPTO-007 | DOCS_ATTESTATION_ED25519_SEED | Ed25519 seed used by the docs sandbox gateway to sign sandbox attestations (DobAttestation with session_id + client_id binding). Distinct from all production attestation seeds. Quarterly rotation, coordinated with shared sandbox issuer identity rotation. Seed held only within the AttestationSigner closure at src/docs/attestation-signer.ts; never materialised as a JS string. 90-day audit retention for sign events. | Cryptography Specialist | Cloudflare Secrets Store (internal identifier redacted) | Restricted |
Infrastructure Assets
Cloud Services (Confidential)
| Asset ID | Asset Name | Owner | Access Control |
|---|
| INFRA-001 | Cloudflare Account | ISMS Owner | 2 admins, MFA required |
| INFRA-002 | GitHub Organisation | ISMS Owner | Team members, admin limited |
| INFRA-003 | Verifier API Worker | Security Lead | Deployed via CI/CD |
| INFRA-004 | Issuer API Worker | Security Lead | Deployed via CI/CD |
| INFRA-005 | Static site serving (Cloudflare Workers Assets) | Security Lead | Deployed via Git |
| INFRA-006 | docs.provii.app/api/* route prefix on the provii-demos/demo-web-provii-agegate Worker. Docs sandbox gateway surface backing the interactive developer onboarding flow. Narrowed DocsEnv binding set with no DEMO_TOKEN_SECRET and no playground KVs. 90-day audit retention. | Security Lead | Cloudflare Workers (provii-demos/demo-web-provii-agegate), sandbox env |
| INFRA-007 | preview.docs-sandbox.provii.app origin. Styler iframe origin that renders interactive documentation widgets. Covered by a dedicated ALLOWED_DOCS_ORIGINS CORS list distinct from the playground allowlist. 90-day audit retention. | Security Lead | Cloudflare DNS + Workers (sandbox env) |
KV Namespaces (Internal/Confidential)
| Asset ID | Namespace | Purpose | Retention |
|---|
| KV-001 | VERIFIER_CONFIG | Verifier configuration | Indefinite |
| KV-002 | IS_KEYS | Signing keys | Until rotation + 1yr |
| KV-003 | IS_AUDIT_LOG | Audit events | 90 days |
| KV-004 | IS_CONFIG | Issuer configuration | Indefinite |
| KV-005 | BANS | Banned IPs/clients | Variable |
| KV-006 | SANDBOX_DOCS_ISSUERS | Browser gateway credential allowlist. Holds docs-sbx-* issuer client IDs minted via the docs sandbox gateway POST /api/credentials/issuer endpoint. Sandbox-only; prod-side middleware rejects docs-sbx-* prefixes across body, path, query, and auth headers. Compromise response: wrangler kv:key list --remote --prefix docs-sbx- sweep delete. 90-day audit retention for KV operations. | Sandbox-only. Entries auto-expire via 1-hour TTL on credential cache; issuer allowlist entries rotate with quarterly shared-sandbox issuer rotation. |
| KV-007 | SANDBOX_MOBILE_ISSUERS | Mobile wallet credential allowlist (per Decision 13). Holds mwallet-sbx-* sandbox client IDs minted for wallet developers. Deliberately disjoint from SANDBOX_DOCS_ISSUERS so a browser-side compromise does not force a mobile-wide credential wipe and vice versa. Compromise response: wrangler kv:key list --remote --prefix mwallet-sbx- sweep delete. 90-day audit retention for KV operations. | Sandbox-only. 7-day TTL on mobile install entries; issuer allowlist rotates quarterly. |
Registered Intellectual Property (Confidential)
| Asset ID | Type | Description | Jurisdiction | Status | Owner |
|---|
| IP-001 | Provisional Patent | System and Method for Privacy-Preserving Age Verification Using Zero Knowledge Proofs (AU 2026901546) | Australia | Filed 2026-02-26. PCT deadline 2027-02-26. | ISMS Owner |
| IP-002 | Trade Mark | PROVII WALLET (Classes 9, 42) | Australia | Filed 2026-02-22. Application number TBC. | ISMS Owner |
| IP-003 | Domain | provii.app | Global | Active | ISMS Owner |
| IP-004 | Domain | proviiwallet.au | Australia | Active | ISMS Owner |
| IP-005 | Domain | proviiwallet.com.au | Australia | Active | ISMS Owner |
| IP-006 | Domain | proviiwallet.com | Global | Active | ISMS Owner |
Code & Intellectual Property (Public)
| Asset ID | Repository | Description | Owner | Classification |
|---|
| CODE-001 | provii-crypto | ZKP implementation | Developer | Public (open source) |
| CODE-002 | provii-verifier | Proof verification Worker | Developer | Public (open source) |
| CODE-003 | provii-issuer | Credential issuance Worker | Developer | Public (open source) |
| CODE-004 | provii-agegate | Browser SDK | Developer | Public (open source) |
| CODE-005 | provii-mobile-sdk | Mobile SDK | Developer | Public (open source) |
| CODE-006 | provii-mobile | Provii mobile wallet (client) repository under the MaelstromAI GitHub enterprise | Developer | Public (open source) |
| CODE-007 | provii-verifier (hosted mode routes) | Hosted verification for simple website integrations (merged into provii-verifier) | Developer | Public (open source) |
| CODE-008 | admin-portal | Internal administration web portal | Developer | Public (open source) |
| CODE-009 | shared-portal-lib | Shared UI components for portal applications | Developer | Public (open source) |
| CODE-010 | provii-management | Internal platform management Worker | Developer | Public (open source) |
| CODE-011 | provii-credit-management | Verification credit tracking and billing Worker | Developer | Public (open source) |
| CODE-012 | provii-status | Status monitoring Worker | Developer | Public (open source) |
| CODE-013 | provii-website | Public marketing website | Developer | Public (open source) |
| CODE-014 | provii-docs | Public developer documentation | Developer | Public (open source) |
| CODE-015 | provii-demos | Integration demo applications (19 ecosystems) | Developer | Public (open source) |
| CODE-016 | shared-rate-limit | Shared rate limiting library (archived; replaced by per-service KV counters) | Developer | Public (open source) |
| CODE-017 | agegate-rust | Native SDK for server-side integrations | Developer | Public (open source) |
Operational Data (Internal)
| Asset ID | Data Type | Location | Retention | Owner |
|---|
| DATA-001 | Audit logs (including IP addresses) | Cloudflare Workers Logs (shipped to Grafana Loki), Cloudflare KV | 90 days; critical security event logs are retained for up to 365 days | Security Lead |
| DATA-002 | Operational telemetry | Cloudflare Workers Logs (shipped to Grafana Loki) | 90 days | Security Lead |
| DATA-004 | CI/CD logs | GitHub Actions | 90 days | Security Lead |
Documentation Assets (Public)
| Asset ID | Document | Owner | Location |
|---|
| DOC-001 | ISMS Documentation | ISMS Owner | maelstrom.au/trust |
| DOC-002 | Technical Documentation | Developer | docs.provii.app |
| DOC-003 | API Documentation | Developer | docs.provii.app |
Access Credentials (Restricted)
| Asset ID | Credential Type | Storage | Owner |
|---|
| CRED-001 | GitHub PATs | Password manager | Individual users |
| CRED-002 | Cloudflare API Tokens | GitHub Secrets (CI/CD) | Security Lead |
| CRED-003 | Password Manager Vault | Cloud-synced, encrypted | Individual users |
Physical Assets (Varies)
| Asset ID | Device Type | Owner/User | Full Disk Encryption |
|---|
| PHY-001 | Developer Laptop 1 | Team Member 1 | ✅ Required |
| PHY-002 | Developer Laptop 2 | Team Member 2 | ✅ Required |
Note: Individual workstations tracked minimally (BYOD model). Security requirements in Acceptable Use Policy.
Asset Lifecycle
New Assets
When adding an asset:
- Assign unique Asset ID
- Classify per Asset Management Procedure
- Assign owner
- Document in this register
- Implement appropriate controls
Changes
When asset changes:
- Update register within 5 business days
- Note change in changelog below
- Review classification if needed
Disposal
When retiring an asset:
- Follow Data Retention Policy
- Document disposal date and method
- Mark as “Disposed” in register
- Archive entry (don’t delete from history)
Asset Review Schedule
Quarterly (Jan, Apr, Jul, Oct):
- Security Lead reviews register
- Verify assets still exist and are correctly classified
- Check ownership assignments
- Update as needed
- Document review completion
Next Review: 2026-11-21
Changelog
| Date | Change | Changed By |
|---|
| 2025-01-13 | Initial asset register created | ISMS Owner |
| 2026-02-16 | Updated repos, ownership, and compliance validation fixes | ISMS Owner |
| 2026-02-27 | Added registered IP assets (patent, trade mark, domains) | ISMS Owner |
| 2026-04-13 | Added docs sandbox gateway entries: INFRA-006 (/api/* route prefix), INFRA-007 (preview.docs-sandbox.provii.app), KV-006 (SANDBOX_DOCS_ISSUERS), KV-007 (SANDBOX_MOBILE_ISSUERS), CRYPTO-006 (DOCS_SESSION_HMAC_KEY), CRYPTO-007 (DOCS_ATTESTATION_ED25519_SEED). Re-classified CRYPTO-003 as shared sandbox issuer identity with quarterly rotation and KV-sweep compromise response. | ISMS Owner |
- Asset Management Procedure
- Data Retention Policy
- Information Security Policy
Document Information
- Version. 1.4
- Last Updated. 2026-05-21
- Owner. ISMS Owner
- Review Frequency. Quarterly
- Next Review. 2026-11-21
- Classification. Public