DDVault / DDWitness
A signed evidence package is only as good as your ability to prove it was never touched. DDVault is the evidence enclave — a sealed store where every artifact stays traceable to its origin and provably unaltered. DDWitness is a hash-only witness — it proves the evidence existed and is unchanged without holding the evidence itself. Together they are the custody layer beneath the suite's signed evidence.
This one is earlier-stage than the rest of the suite. We are building it in the open with design partners, so the diagrams below describe the concept and the design intent — not a shipping console with screenshots to show yet.
Two parts, one custody layer
DDVault · the evidence enclave
A sealed store for compliance evidence. Each artifact is bound to its origin on the way in and kept under chain of custody, so the record you hand an assessor is the record the scan produced — not a copy that could have drifted. The vault is designed so anything altered after sealing stops verifying, rather than passing silently.
DDWitness · the hash-only witness
A witness that attests evidence existed at a point in time and has not changed since — using only its cryptographic hash, never the evidence itself. Because it holds no content, it is privacy-preserving and air-gap friendly: you can prove integrity to a party that is never allowed to see the underlying data.
How custody flows
1 · Origin
An artifact is captured — a scan result, a config snapshot, a signed evidence file — and bound to where and when it came from. Custody starts at the source, not at upload.
2 · Seal into DDVault
The artifact enters the enclave under a tamper-evident seal. From here on, any change to the bytes is meant to be detectable, so a quiet edit cannot pass as the original.
3 · Witness with DDWitness
DDWitness records the artifact's hash — a fingerprint, not the file. That fingerprint is the proof that this exact evidence existed at this time, and it travels where the evidence cannot.
4 · Walk the chain
An affirming official, counsel, or a DIBCAC reviewer can trace any artifact back to its origin and confirm it is unaltered — walking the chain instead of taking the score on faith.
What makes evidence defensible
Every artifact is traceable to its origin. The trust vein of an assessment is being able to walk any piece of evidence back to where it came from.
The enclave is designed so an artifact changed after it was sealed stops verifying. Untouched is something you can demonstrate, not just assert.
DDWitness proves integrity from a hash alone. It confirms the evidence is unaltered while holding none of it — so the proof can go where the data is not permitted.
Because the witness carries fingerprints rather than files, integrity can be proven across a boundary that never lets the underlying evidence cross it.
Why custody is worth more than the license fee
A DoD contractor's self-attested SPRS score is a False Claims Act matter. The affirming official signs a personal attestation to the federal government, and each invoice that follows carries the claim that the posture still holds. The FCA does not punish being wrong — it punishes being knowingly, recklessly, or deliberately-ignorantly wrong. What separates an honest, good-faith score from a reckless one is the record behind it.
That is the exposure DDVault and DDWitness are built to help you defend. Evidence that is traceable to its origin and provably untouched is what lets you show the score reflected the real configuration at the time you signed — the difference between "your score was wrong" and a documented, good-faith assessment. It supports the defensible record; it is not a guarantee against liability, and no software can promise that.
Help us build the custody layer your evidence deserves.
DDVault and DDWitness are in early development. We are inviting design partners to shape how the evidence enclave and the hash-only witness work in real CMMC environments — before general availability. Get early access, and put your custody requirements in the design.