0010 Originals in two places: a different location, inside Korea, and encrypted when held by outside companies
The Korean version is authoritative. This page was translated by AI (Claude) and has not yet been checked by a person. 한국어 원문
The second location is an external disk, to be bought separately later (the head of Nodeone, 2026-10-12).
This restores the September specification’s redundancy rule to 04-layer section 4, “There is one layer 1 store”. It was dropped when the text moved into the hgp documents.
- One store means one party responsible for protection. The original exists physically in two or more copies. The original and its copy are kept in different locations. Another folder on the same computer, or another disk in the same room, is not a different location.
- They are kept inside Korea (September specification HGP-0003 article 12, HGP-0007 section 3).
- When kept with an outside company (cloud and so on), they are sent only encrypted. That company must not be able to see the original (the same meaning as principle 3 and “the administrator cannot see content” in 01-Permissions).
- Copies are also checked against fingerprints. Regular checks (02-Fingerprint section 3) also run on copies. If an original has changed, it is restored from a copy with the same fingerprint.
- The ledgers (
fixity.tsv, volume fingerprints, permission records and so on) are also kept in two places, like the originals. Without the ledger, an original cannot prove that it is the original.
Documents updated: 04-layer section 4 (v0.4).
- It is already in section 3 of HGP-0007 in the September specification: “Keep redundant copies. The original master and the copy are kept in different locations.” We align with what already exists.
- A fingerprint only tells you that an original has changed; it cannot restore it. 02-Fingerprint section 3 said “restore from backup”, but no document said where that backup is kept.
- Today the arkive originals (297 scans) exist on only one machine, the main server (two folders on the same disk). The main server’s daily backup covers only the public zone, and even that is stored inside the same main server. If one disk fails, the originals are lost.
Other options (second location)
Section titled “Other options (second location)”| Option | Pros | Cons |
|---|---|---|
| Daily copy to an external disk or NAS at another site (office, home) | No outside company. A one-time cost | Who looks after that machine? Connected only over Tailscale |
| Encrypted, in a Korean cloud (Naver Cloud, KT and others) | Little for people to look after | A monthly cost (approval required). Where is the encryption key kept? |
| Overseas cloud (Backblaze, AWS and others) | Cheap | Goes against the rule of keeping data inside Korea. Not chosen |
| No redundancy, as now | 0 won | One disk could lose the originals. Principle 1 (the original belongs to its owner) and principle 4 (authenticity can be proven) cannot be kept |
Where it has effect
Section titled “Where it has effect”- server session: set up a daily copy to the second location (all arkive originals; the secretary staging store from when its daily-use version is switched on). hgp does not edit the server folder, so it tells the head of Nodeone. arkive has already left the same request (arkive report 2026-10-12, “no backup of originals on the main server”).
- arkive: make the daily fingerprint check also run on copies (arkive to-do).
- secretary: after the originals move to arkive in v0.2, it follows arkive’s redundancy. Until then, the staging store follows the same rule.
Depends on the second location. An external disk is a one-time cost of around 100,000 to 200,000 won; a Korean cloud is monthly, depending on capacity. The arkive originals are currently 295MB, which is small either way.