Two-region link
strong consistencyRegion A
us-east-1Region B
us-east-2Spend cap
per minorParent actions
server actionsPlatform gate
reference integrationThe call a platform makes at the gate. It reads the strongly-consistent projections, so the decision is identical in both regions. Reference integration contract, synthetic data.
curl -X POST custody-zeta.vercel.app/api/authorize?region=west \
-H 'content-type: application/json' \
-d '{"userId":"...","minorId":"...","action":"spend","amountMinor":1800}'Tamper-evident ledger
sha-256 hash chainConcurrency
occ under contentionFires real concurrent appends against the live Aurora DSQL cluster. A hot key makes them collide on the composite primary key, returning real SQLSTATE 40001 conflicts that the retry wrapper resolves into one unforked chain. Random keys (hot key off) spread writes so they do not conflict. Synthetic throwaway subjects.
Age verification
sd-jwt selective disclosureissuer credential
- date of birth
- 2012-**-**
- age bracket
- 13-15
disclosed to platform
run the proof
Compliance mapping
supported regimesCustody supports compliance with these regimes. It is a neutral system of record, not a legal certification, and the regulated platform remains the responsible party. Each row links a built, live feature to the obligation it provides evidence for. Click a row to jump to the feature.
Platforms accessible to minors must take proportionate measures for a high level of minors' privacy, safety, and security.
Withdrawing consent must be possible at any time and as easy as giving it.
Below the applicable age (16, or as low as 13 by member state), consent-based processing of a child's data is lawful only with verified parental authorization.
Personal data must be limited to what is necessary for the purpose (data minimisation).
On withdrawal of consent with no other legal ground, the controller must erase the personal data without undue delay.
Operators must obtain verifiable parental consent before collecting a child's personal information.
Services likely to be accessed by children must apply highly effective age assurance and proportionate protection, enforced by Ofcom.
Architectural note: Amazon QLDB ends support on 31 July 2025. Custody rebuilds its tamper-evident, hash-chained ledger capability in the application layer on Aurora DSQL.