Information lifecycle

Lifecycle

Each stage in the lifecycle is independent and does not imply progression to the next. Information may be preserved without review, reviewed without export, and exported only through deliberate human action.

1. Ingest
2. Preserve
3. Structure
4. Notify (informational)
5. Review
6. Package

Lifecycle narrative

Ingest accepts only configured inputs; the system does not discover or infer unattended sources. Preserve stores records in a tamper-evident form; preservation does not constitute an investigative determination. Structure organizes events, timestamps, and derived attributes to support human review; structuring does not resolve identity.

Stage clarifications

Ingest

Inputs are explicitly configured and authorized by the deploying organization. The system will not autonomously connect to or infer new surveillance sources.

Preserve

Records retained by the system are stored with integrity controls and metadata sufficient for audit. Preservation is neutral with respect to investigative outcomes and does not equate to endorsement or determination.

Structure

Structuring extracts and normalizes fields to enable correlation. Normalization choices are documented and reversible; they do not assert identity or intent.

Notify (informational)

Notifications indicate availability of information or new correlations. Notifications do not carry operational instructions, required timelines, or escalation authority.

Review

Review is a human-controlled action. Access and analysis actions are logged and attributable; the system does not decide whether a record is evidentiary.

Package

Export and packaging are explicit, auditable operations executed by authorized users. Packaging records provenance and the identity of the exporting user; packaging does not itself impose enforcement or operational steps.