Document management for companies and public institutions
Records described, evidenced and accounted for.
Archystream is a document management platform for organisations that must answer for their records. Upload a contract and it comes back described — parties, dates, reference numbers — with every value pointing at the place in the document it was read from.
STRUCTURE. STREAM. SECURE.
One platform for the full document lifecycle
Who it is for
Public institutions and regulated companies
Companies
Contracts, personnel files, invoices and technical documentation — described consistently, searchable across the organisation and shared only where authorisation allows.
- Contract and personnel archives
- Sharing governed by access rules
- Line-of-business integration
- Employee and customer data requests on a legal deadline
Public institutions
Registers, case files and official archives held with the traceability, retention discipline and export formats that oversight requires.
- Statutory retention terms
- Complete history for inspection
- Separation between departments
- Citizens' data requests that respect retention
Product
The capabilities a records system needs
From controlled ingest to standards-based export, built into the platform rather than added around it.
Documents and folders
A typed hierarchy of folders and documents with versioning, in-browser preview and structured sub-records for repeating detail such as parties, amounts or measurements.
A metadata model you define
Document types, attributes, controlled value lists and validation rules, configured per repository. The model follows your record series; you do not reshape your records to fit the software.
Controlled ingest
Every file is virus-scanned before it becomes available, and its format is identified from content rather than from the name it arrived with. Text is extracted from born-digital files, OCR is applied to images, and documents without a text layer are flagged for attention.
Full-text search
Document text, metadata and structured sub-records are indexed together, so a search term matches whether it appears in the content or in a described field.
Retention terms on the record
Retention periods, access restrictions and disposal actions are held as attributes of the record and are extracted from document text where stated. Because a wrong value can mean a record destroyed too early, these values are always confirmed by a person and never applied automatically.
Audit trail and provenance
Who created, changed or reviewed a record, and which processing stage produced which value — recorded as events, with preservation events kept as first-class entries for inspection.
Access control per document
Attribute-based rules evaluated on every request against the metadata of the specific document, so permissions can depend on classification or status rather than on folder position alone.
REST API and search index
A documented REST API and a queryable index make the archive available to the case-management, finance and line-of-business systems already in use.
Product tour
A short look at the application
Captured from the running application, not mocked up for the occasion.
Dashboard
What you see after signing in
Document and folder counts, the space they occupy and the breakdown by format, with the most recently changed documents and folders beside them — or any other widgets you configure.
01 / 08
Extraction and automated description
Description that shows its working
Archystream describes documents as they arrive and records where every value came from — so a reviewer checks a citation instead of re-reading the file.
How a document becomes a described record
- 1Arrival
Received and secured
Virus scan, SHA-256 digest, format identified from content rather than from the file name.
- 2Queue
Queued for description
Deeper analysis runs on a queue operators can inspect, retry and cancel per document.
- 3Extract
Read, not guessed
Embedded properties, email headers, document text and OCR for images, then configurable rule packs for references, identifiers and dates.
- 4Evidence
Every value cited
Each value is recorded with its page, verbatim quotation, character range, method and confidence.
Confirmed automatically
Facts read directly from the file: format, size, page count, digest.
Proposed for review
Anything inferred, queued by field so one decision covers many documents.
Always decided by a person
Retention, access restriction and other legal-consequence fields, at any confidence.
- 5Describe
Projected into your fields
Confirmed values populate the attributes your record series already uses, and the search index.
- 6Export
Native, Dublin Core, PREMIS
Fixity from the stored digest, stamped with the profile and vocabulary version used.
Times are from a 104-document reference corpus on a developer machine: available in seconds, fully described in minutes, and re-described in a fraction of that when only a rule changes.
Deterministic extraction on arrival
Format identified from content, embedded document properties harvested, email headers read for correspondents and threading, and configurable rule packs matched for references, registration numbers, financial identifiers and dates.
Every value cites the document
Each proposed value carries the page, the verbatim quotation and the character range it came from. A quotation that cannot be located in the stored text is flagged rather than accepted — the signal that something was inferred rather than read.
Values are proposals, not overwrites
Extracted values are recorded with their method, confidence and origin. Two sources may disagree without one silently replacing the other, and a reviewer's confirmation is recorded as a decision. Even “this document states no case reference” is a finding that can be recorded.
Confidence with limits that hold
Facts read directly from the file are confirmed automatically. Anything inferred is proposed for review, and fields with legal consequence — retention, access restriction — are never auto-confirmed at any confidence. A scan date is never quietly adopted as a record's creation date.
Review by field, not by document
Reviewers confirm one field across many documents in a single pass, with the citation beside each value and the source document alongside the form. Correcting a name once applies that correction wherever the same form appears.
Standards-based export
The same description exports to Dublin Core and PREMIS as well as the native schema, with the fixity digest taken from the stored checksum and each export stamped with the profile and vocabulary version that produced it.
Measured, not asserted
Accuracy reported per field and per document type
Automated description is only useful if its reliability is known. Archystream measures itself against frozen reference sets and reports the result field by field. A single overall accuracy figure hides the difference between a born-digital form and a poorly scanned one, and that difference determines how much review your team will actually do.
Reference sets are frozen, so one run can be compared with the run before it
Results are broken out by document type, never averaged into a single number
Fields with too few examples are reported as unmeasured rather than scored on noise
Correct abstention counts as a success, so silence is neither rewarded nor punished by accident
Smart Search
The model writes the search, never the answer
Describe what you are looking for in a sentence, and it becomes the same conditions Advanced search uses — shown beside the results, so you check what was understood rather than take it on trust. The model interprets your question; the description of your documents stays deterministic.
Conditions, never answers
The model produces search conditions, not search-engine queries and not text of its own. The platform re-validates every field, operator and value against your data model before anything runs, and a condition that fails the check becomes a visible warning rather than a silent drop.
Your documents stay in the system
Documents and their content are never sent to the model, wherever it runs. The only thing it interprets is your question — the search itself runs inside the system, like any other search.
Your access applies unchanged
The conditions run through the ordinary search, and your access rights are applied inside the query by the platform, not by the model. Fields you have no right to filter on are never offered to it.
Understanding you can check
A sentence can be understood imperfectly, which is why the conditions are always shown next to the results, in plain words. If they are not what you meant, reword the sentence — or build the search yourself: Advanced search is always there.
Empty results are diagnosed
When nothing matches, the platform probes the index itself — deterministically, under your own rights — to find the condition at fault and a replacement that is counted before it is proposed. The model only rewords the sentence, and no suggestion ever runs by itself.
Recorded like any search
Every Smart Search lands in the audit trail with the sentence and the model that interpreted it. The feature is off until the archive's managers choose a model for it.
What Smart Search does not do
- It does not answer questions. It finds documents. What they say is for you to read — nothing is summarised or generated.
- It does not know the words inside your documents. A value typed in the sentence is searched as written: a country typed one way will not match documents that spell it another.
- It does not replace Advanced search. Complex combinations still belong there, and the Advanced search tab stays available in every archive, with or without a model.
Tracewell · Data protection
Deleting a document does not erase a person
When someone asks you to erase their data, removing the file is the easy part. Tracewell, the data-protection module built into Archystream, finds the person's data wherever a copy survives, handles the request within the legal deadline, and gives you a written account of what was done.
Where a deleted document lives on
- Earlier versions
- Copies
- Search index
- Caches
- Audit trail
- Backups
Tracewell erases the person from the first five and checks each one again afterwards. Backups cannot be changed in place: they expire on a stated date, and if one is restored, the erasure is applied again automatically.
Know where personal data is
Mark which fields of each document and folder type hold personal or sensitive data, such as health, bank or national ID details. A scheduled Trace sweep looks through text, metadata and file names for e-mail addresses, phone, IBAN, card and national ID numbers, and flags documents for review. It changes nothing and never stores the value it found.
Requests answered within the deadline
A person can ask to see their data (Reveal), correct it (Amend), erase it (Dissolve), limit its use (Restrain) or take it elsewhere (Carry). Each request runs on the deadline of the law you choose. The identifiers they give you are stored encrypted, kept out of links, logs and the audit trail, and destroyed once the request is closed.
Erasure that reaches every copy
Remove deletes the document with all its versions, copies, search entries, caches and audit values. Blur replaces the identifying details for good, with no key kept to reverse it, and blacks them out in the file itself — PDF, Office or text — for the Trace Warden to compare side by side. A second warden or a manager approves before anything is erased.
Proof you can send to the person
After the erasure, a verification report checks every store for anything left. The Clearance Statement, a letter in English, Romanian, German, Italian or French, tells the person what was searched, found and done — only what the check proves — and what cannot be erased at once, such as backups, with the date they expire.
Retention comes first
A contract or invoice you must keep by law is never deleted. Its details are anonymised and the original file is sealed: no one can open it, managers included. It is destroyed automatically when the retention period ends. Until then, a user can ask to see it, giving a reason, and a manager can grant that one user access for a limited time.
A record for the authority
A Purpose Charter of your processing, ready to export. Fade periods — how long data may be kept — with a report of what is due or overdue. A register of Exposure Events with each law's notification clocks, such as 72 hours under the GDPR. A dashboard and eleven reports built on counts, with no personal values in any export.
A sealed original, seen without handing over the file
When a manager grants access, the viewer shows each page as a picture drawn by the server. Every picture carries the viewer's name, the time and the grant. The file itself is never sent to the browser.
- A document of 160 pages opens in under a second.
- Download only if the manager allows it. The copy carries the same watermark, unless the manager deliberately hands out the exact original — for example, as evidence for a court.
- Every page viewed is recorded.
A watermark cannot stop a screenshot or a photo of the screen. It makes every copy traceable to the person and the grant behind it.
In the application
Tracewell dashboard
Open requests, deadlines, sweep results and pending approvals, shown as counts.
Holder requests
Every request with its kind, status, law and deadline. The register never shows identifiers.
Verification report
After an erasure, each store is checked again. Whatever has to wait is listed with its date.
Granting access
A manager grants one user access for a set period, and decides on download and watermark.
The terms you will see in the application
Tracewell gives the legal terms short names of its own. The screens above use them.
- Identity traces
- personal data
- Guarded traces
- sensitive personal data, such as health or national ID details
- Trace holder
- the person the data is about
- Trace Warden
- the role that handles privacy work, granted per repository
- Reveal · Amend · Carry
- requests to see, correct or take away one's data
- Dissolve · Restrain
- requests to erase data, or to limit its use
- Remove · Blur
- the two ways to erase: delete, or anonymise for good
- Purpose Charter
- your records of processing
- Ground
- the legal basis for processing
- Fade period
- how long data may be kept
- Exposure Event
- a data breach
- Clearance Statement
- the letter that closes an erasure request
Deadlines included for these laws
- GDPR (EU)
- UK GDPR
- nFADP (Switzerland)
- CCPA/CPRA (California)
- LGPD (Brazil)
- PIPEDA and Law 25 (Canada, Québec)
- PIPL (China)
- APPI (Japan)
- DPDP (India)
- PIPA (South Korea)
- PDPA (Singapore)
- POPIA (South Africa)
- Privacy Act (Australia)
These deadlines are defaults you can edit, not legal advice. Confirm them with your own counsel before you rely on them.
What Tracewell does not do
- It does not make you compliant on its own. It helps you meet the requirements. Whether you do is for you and your counsel to judge.
- It does not recognise names in running text. The sweep finds identifiers with a fixed form, such as e-mail addresses and account or ID numbers.
- It cannot prevent a screenshot. The watermark makes every copy traceable. It does not stop a photo of the screen.
- It cannot erase backups on the spot. They expire on the date the Clearance Statement gives. If one is restored, the erasure is applied again automatically from a separate erasure ledger.
Platform
A stack designed for isolation
Every layer is multitenant, and every layer separates one customer from the next.
Storage
S3-compatible object storage for content, with a SHA-256 digest recorded for every version, and a dedicated database per repository for description.
Description
A canonical model of identity, subject, agent, activity, event, rights, technical and relation facets, projected into the field names your organisation already uses.
Identity
A dedicated identity realm per customer: their own identity provider, password policy, lockout rules and session limits, with tokens accepted only from registered issuers.
Processing
Two-tier ingest makes documents available in seconds while deeper analysis runs on a queue operators can inspect and retry. Stage-level caching means changing an extraction rule re-runs that stage alone.
Interfaces
REST API, search index and event streams for the systems around the archive.
Security and compliance
Separation by architecture
The guarantees below follow from how the platform is built, not from settings an administrator must remember to apply.
Tenant isolation
Each repository has its own database. Customer records are never mixed in shared tables, so isolation does not depend on a query filter being correct.
Identity per customer
Each customer authenticates in their own realm against their own identity provider, with their own password and lockout policy. Tokens are accepted only from registered issuers.
Authorisation on every request
Attribute-based rules are evaluated per request against the specific document, and the interface offers an action only where the same rule would permit it.
Fixity and provenance
A SHA-256 digest is recorded for every stored version and reported in PREMIS export, alongside the preservation events describing what was done to the file and when.
Sensitive values masked
Fields marked as sensitive show “Restricted” to anyone without an explicit right to view them — on screen, in search results and in exports.
No access for the operator
Platform administrators who run the service have no access to your documents. The Trace Warden right is granted per repository, the warden sees unmasked data only while a case is open, and every act is audited.
How we work together
From your record series to a working archive
A demonstration is the first step. What follows is a pilot on your own documents, measured before you commit to anything.
Start from your record series
We begin with the document types you hold, the fields you need described, which of them hold personal data, and the retention and access rules that apply — not with a generic template.
Configure a repository for them
A metadata model with your attributes and controlled value lists, rule packs for your references and identifiers, and an identity realm connected to your own identity provider.
Measure on your own documents
You provide a representative sample. We measure description quality against it, field by field, so you know how much review to expect before any commitment.
Bring the archive in
Bulk ingestion of the existing holdings, integration with the systems around the archive through the REST API, and a handover to your reviewers and administrators.
See Archystream with your own documents
Tell us about your record series and we will walk you through a portal configured for them, including the description quality we measure on documents like yours.
Or write to us at [email protected]