ARIA1.0
English only · Spanish [PLANNED]

Who holds what: registry, TLF, receiver

Three parties touch an agent's identity. Each holds something the others never see. The normative statement is §9 of the specification; this page lays it out.

The registry (Registration Authority)

HOLDS
  • The Case File: evidence of every verification it performed (EXP-01)
  • The customer relationship: account, billing, contact details
  • KYC documents and the identity of the responsible person
  • The organization’s tenant signing key (revocation and delegation records)
NEVER HOLDS
  • The agent’s private holder key: generated and kept on the controller’s machine
spec →

TrustLayer Foundation (Authority)

HOLDS
  • The namespace: uniqueness of every did:aria
  • The public signed credential (the AID) and the status list
  • The Trust Ledger: which registry asked, which identifier, when — hash-chained, append-only
NEVER HOLDS
  • Any personal data: no name, no document, no contact detail
  • The Case File, which stays with the registry
spec →

The receiver (your system)

HOLDS
  • Your admission policy: the _aria-policy TXT and the copy your evaluator enforces
  • Your own logs of which agents arrived and what you decided
  • Your freshness bound for status evidence (fresh=)
NEVER HOLDS
  • Anything about the principal beyond what the public AID states
spec →

Why legalName is an organization name

The public AID names an organization, never a natural person. Natural-person principals at any level do not populate legalName (COM-09, L0-03). The person behind an agent is known to the registry, which verified them, and appears nowhere in the document that travels. That is what lets the Trust Ledger be append-only without holding personal data: there is nothing in it to erase.

The GDPR question, answered by design

The right to erasure conflicts with an immutable ledger only if the ledger holds personal data. It does not: it records which registry asked for which identifier and when. Redaction of a ledger entry exists as a safeguard, not as the design (§9).

What this means for you as a receiver

You hold your own policy and your own logs. Nothing in the protocol requires you to store anything about the principal beyond what the public AID states, and the AID states nothing personal. If your logs record legalName, remember what it is at L0: a self-declared label.