Evidence kinds/Operator-managed signing key

Operator-managed signing key

cryptographic evidence

The Ed25519 private signing key is generated + held operator-side, never escrowed by Promethean.

What it is

On signup, the workspace generates an Ed25519 keypair locally. The private seed is stored in the operator's environment (encrypted at rest per their key-management policy); the public key is published in the workspace identity.

This is the structural answer to 'can Promethean forge entries?'. Answer: no, because Promethean never has the private key. Even if Promethean infrastructure were compromised, an attacker couldn't sign new entries appearing to come from the operator's workspace.

Scale + Enterprise tiers will add HSM custody (roadmap) — the private key will be generated + held in an HSM (CloudHSM, on-prem HSM, or hosted HSM provider) and never leaves it. For regulated customers (healthcare under HIPAA Security Rule, financial entities under DORA Art. 28 third-party-ICT-risk), this is often required.

What it guarantees

  • No Promethean-side custody of private key at any tier.
  • Forgery-resistance against Promethean infrastructure compromise.
  • HSM-grade custody on the roadmap for Scale + Enterprise.

What it does NOT guarantee

Honest limits. Every primitive has them.

  • Operator-side key management hygiene — that's the operator's IAM + encryption posture.
  • Resistance to operator-side compromise — if the operator's environment is breached, the key is at risk.

Regulations that engage this kind

GDPR Art. 32

Security of processing

NIS2 Art. 21(2)(h)

Cryptography

HIPAA §164.312(a)(2)(iv)

Encryption + decryption (addressable)

Sectors that rely on this kind

Related evidence kinds

Ed25519 attestation

Per-entry Ed25519 signature using the operator's workspace signing key.

Audit bundle

Operator-downloadable .zip containing verifier + workspace identity + chain metadata + framework handoff.

FAQ

Can we use an HSM on lower tiers?

HSM hooks are on the roadmap for Scale + Enterprise. Today, on all tiers, the key is stored in the operator's environment (env variable or filesystem-encrypted) — operators can BYO-HSM with custom integration if their KMS already supports it. Regulator expectations + customer contracts often force HSM on healthtech + financial-sector deployments; the formal Promethean-supplied hooks ship on Scale + Enterprise per the roadmap.