Overview#
A financial crime prosecutor preparing for trial needs every document from a three-year investigation packaged in a format that courts will accept. Each document must carry a Bates number for reference during proceedings. The package must include a cryptographic integrity proof showing nothing has been altered since export. The defence team needs a secure link that expires after seven days. None of that should require custom scripting or manual assembly. The Export domain delivers it as a single workflow: select the scope, choose the format, and receive a disclosure-ready package with all the legal scaffolding built in.
Evidence-grade export is not just about file conversion. It is about producing materials that survive chain-of-custody scrutiny in court, satisfy regulatory disclosure timelines, and give recipients confidence that what they received matches what was packaged.
Key Features#
- Multiple export formats: PDF/A-3 archival, HTML, JSON, STIX 2.1, EDRM, and native
- Bates numbering for legal discovery with automatic sequential assignment
- Trusted timestamping for evidence integrity verification via TSA integration
- Merkle tree cryptographic integrity proofs with independent verification capability
- Disclosure bundle creation with recipient tracking and deadline management
- Secure sharing with time-limited access tokens, session limits, and download tracking
- Privacy and redaction support with multiple levels, from none through maximum anonymisation
- Streaming exports for large productions with progress tracking and queue management
- Scheduled recurring exports with cron-based configuration and email notifications
- Audit chain with immutable hash-linked records
- QR code verification for disclosure bundles
- Compliance reporting for GDPR, CCPA, and HIPAA
Use Cases#
- Creating evidence-grade exports for court filings with trusted timestamps and cryptographic integrity proofs
- Packaging legal disclosure bundles with sequential Bates numbering for discovery proceedings
- Sharing investigation materials externally using time-limited secure access tokens that expire and can be revoked
- Scheduling recurring compliance report exports for regulatory obligations on defined timetables
Industry Context#
National police prosecution teams export investigation packages for court proceedings requiring PDF/A-3 archival format with Bates numbering and chain of custody attachments. Financial crime regulators request structured EDRM-format productions for eDiscovery. Intelligence agencies export STIX 2.1 threat reports to share indicators with partner organisations through standardised machine-readable formats. Government agencies with GDPR reporting obligations schedule recurring anonymised compliance exports. Corporate legal departments share time-limited secure links to reviewed document sets with external counsel during litigation.
Integration#
The Export domain integrates with blob storage for file management, Disclosure Service for legal packaging, Sharing Service for token generation, TSA Client for timestamp requests, and Audit Service for chain verification.
Open Standards#
- ISO 19005 (PDF/A, parts 1-4): Archival export packages are produced in selectable PDF/A variants (ISO 19005-1:2005 through ISO 19005-4:2020), with the XMP conformance declaration and embedded files handled per each part's requirements, satisfying court and long-term archive regimes.
- RFC 3161 (Internet X.509 PKI Time-Stamp Protocol): Every evidence-grade export package can include a Time-Stamp Authority receipt obtained via RFC 3161, binding the package manifest digest to a trusted clock and providing legally verifiable proof that the content existed at a specific point in time.
- PKCS#7 / Cryptographic Message Syntax (CMS): A detached CMS/PKCS#7 signature file is generated over the signed package manifest, allowing recipients to independently verify the export's authenticity and integrity using standard tooling.
- OASIS STIX 2.1: Threat intelligence exports are serialised as STIX 2.1 bundles containing indicator objects with standardised type fields, enabling machine-readable sharing of indicators with partner organisations through a widely adopted format.
- EDRM XML (Electronic Discovery Reference Model v1.2): Investigation materials can be exported as EDRM-format XML documents, producing structured productions compatible with eDiscovery review platforms used by regulators and legal teams.
- OASIS Common Alerting Protocol (CAP) v1.2: Incident data is exported as well-formed CAP 1.2 XML documents under the canonical OASIS namespace, mapping severity, urgency, category, and geographic area to the standard element vocabulary for interoperability with alerting systems.
- NIEM 6.0 (National Information Exchange Model): Incident records are serialised as NIEM 6.0 JSON-LD documents using the niem-core, JXDM 7.2, and emergency-management namespace contexts, supporting data exchange with law enforcement records-management systems.
- ISO/IEC 27037:2012: The Bates numbering and court export workflows are implemented in compliance with ISO/IEC 27037:2012 guidelines for the identification, collection, acquisition, and preservation of digital evidence.
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14