EvidenceVaultBuilt for evidence that has to be perfect when you ask for it back.
EvidenceVault is the long-term cold-storage layer purpose-built for digital forensic evidence. Every feature exists to make the chain of custody self-evident — to investigators, auditors, the courts, and the force's own future self.
Customer-managed key in the force tenant's own Azure Key Vault. Disable the key from the force portal and the operator cannot decrypt — verifiable in under a minute, every time.
Sealed evidence is written to version-level WORM blob storage with double encryption (CMK on top of platform key). Mutation is technically impossible, not just policy-blocked.
Every action carries SHA-256(prev || row). Tamper any single row and every link after it breaks. The Verify Integrity button on /audit recomputes the chain in milliseconds and pinpoints any divergence.
Cool → Cold at 30 days, Cold → Archive at 90 days. Per-blob retention derived from offence-category policy. Lifecycle runs in Azure Storage; nothing to schedule, nothing to forget.
Retrievals require a typed reason and Inspector approval. SLA computed from urgency tier; every read is logged against the case. Drift on hash recompute auto-quarantines to a separate WORM container.
Force users and the platform operator never share a sign-in surface, a cookie, an origin, or a .NET project. The operator can observe lifecycle but never touches data plane — enforced in the build graph, not just policy.