How to read this page
- Every step names the tool or the part of Munitas where it happens. The label under the title says where, and the step reads in the same order each time: what is happening, the evidence, and then what to look for in it.
- Console steps happen in the Munitas console, the web app that people open in a browser. They show real screenshots, and clicking one enlarges it.
- Python steps happen in Python, on the person’s own computer, in a notebook or in a terminal. Python is a window where a person types a line and sees the answer straight away. From there the person uses the Munitas client library, which sends requests to Munitas, and DuckDB, a free tool for analysing tables. Each dark box on the page is one of these steps.
- In a dark box, the top part is exactly what was typed and the bottom part is exactly what came back.
meis the client library signed in as the person named on the label, andcustodianis the client library signed in as the custodian. - Every step was run for real by a script that types each one, so the answers are genuine and nothing has been edited. Every name of a person, patient or card holder in the example data is invented.
Words used on this page
- Organisation
- A company or hospital group that uses Munitas. Each organisation sees only its own data.
- Department
- A team inside an organisation that owns some of its data, such as Cardiology.
- Dataset
- A named collection of records, such as a table of patient admissions.
- Sealed
- Finished and closed for good, so that it can never be edited.
- Custodian
- A person who holds the data custodian role, which allows deciding who may read data. A custodian decides for the departments they are an approver for.
- Platform administrator
- The person who runs Munitas itself. The role gives no say over who may read any department’s data.
- Legal hold
- An instruction from a court, a regulator or a law firm to keep an organisation’s records and not delete them while a legal matter is open.
- Temporary custodian
- The person a legal hold names to answer for the kept records while the hold stands. The person confirms having read the notice.
- Data protection officer
- A person who watches how an organisation handles personal data. The role decides nothing about who may read it.
- Export for a legal matter
- Producing some of an organisation’s kept records for a court, a regulator or a law firm that has demanded them. It needs a legal hold in force and three different people.
- Filter
- Keeping only the rows of a table that match values the custodian names, such as one patient’s id, so that other people’s rows do not leave with them.
- Manifest
- The list of every file in a package, each with its size and a fingerprint of its contents. The platform signs it, so that changing a file or the list can be noticed.
- Passphrase
- A long secret that opens an encrypted file. It travels separately from the file, so that having the file alone is not enough.
- Fingerprint
- A value worked out from the exact contents of a file. It changes if even one byte changes, so it shows that a file was not altered.
- Claim
- A statement, made by the person who brings a dataset in, about how sensitive it is. A different approver of the owning department has to confirm it.
- Version
- One sealed state of a dataset. Changing the contents means making a new version, never editing an old one.
- Closing down an organisation
- Ending an organisation’s use of Munitas in two stages of 15 days. In the first its people can read and may cancel. In the second they can do nothing. When both end, everything inside the organisation is deleted.
A court demands the records
This story starts where the walkthrough about closing down an organisation ends. Harbour Clinic is closing down, and a legal hold is in force on it. A legal hold is an order to keep an organisation’s records and not delete them. It only keeps them. Now the High Court has demanded the appointment records of the patient who is making the claim, Ms Alder, together with the log of who read them. The clinic’s appointments are one table of ten rows, covering five patients, so handing over the whole table would send four other patients’ records out with it. Producing records is a different act from keeping them, so the platform gives it its own steps. Three different people each do one step, and none of them reads the records. Priya is a platform administrator, a person who runs Munitas itself and who has no say over who may read any department’s data. To start this story the clinic was closed down through the platform and the first 15 days were skipped by a script run by an administrator, which moves the clinic’s two closing dates back and changes nothing else. The dates on the screens are therefore earlier than they would be on a real calendar.
Under every legal hold that is in force there is a section called Producing records for this matter. A hold that is only waiting for approval, or that has been released, has no such section, because the platform produces records only while a hold stands. The section repeats the three steps in one sentence before it offers anything.
The form asks for what the court sent, in the court’s words: who is demanding the records, the reference of the demand, its date, and what it asks for. It also asks who receives the package. Then Priya chooses which datasets are included. A dataset is the platform’s name for a registered, named collection of records. Choosing a dataset includes every sealed version of it, and a sealed version is a finished state of a dataset that can never be edited. A dataset that is a table offers a second choice: hand over the whole table, or only the rows for named people, matched on one column. Priya chooses the second. Priya does not name the people. The custodian does, in a later step, because the custodian answers for the records.
Nothing has been built yet. The request is stored with who asked and when, and it waits for a different platform administrator. The first thing it records is the audit trail, the permanent list of every decision the platform makes, so the request itself is evidence that somebody asked.
The page draws the Approve button for every platform administrator, and the platform decides when it is pressed. It refuses the person who asked. The same rule is written into the database as a check, so a fault in the program could not bypass it. The refusal is also written to the audit trail.
A second platform administrator approves it
Ravi is the second platform administrator. Ravi and Priya hold the same role, and the rule is only that the two are different people.
Ravi sees the same waiting request with the whole demand in front of the decision. The note is stored with the decision. It is required only when a request is declined.
Approval is the second of three steps. The platform administrators have done their part, and nothing is built yet, because the person who answers for the records has not confirmed what is included.
The custodian names the claimant, and is given the passphrase
Adeyemi is the clinic’s data protection officer, and the legal hold names Adeyemi as its temporary custodian, the person who answers for the kept records while the hold stands. The clinic is in its second stage, so the usual screens are closed to Adeyemi. The one thing still open is what concerns the hold.
Besides the hold, the notice now shows the export that waits for the custodian. The custodian sees the whole demand, who asked and who approved. Only the custodian can confirm that what is asked for matches the demand and goes no further, because the custodian answers for the records. Neither platform administrator can. For a table that is filtered there is one more thing only the custodian does: name the people the demand is about.
Adeyemi types the claimant’s patient id, P-4471, which is the value the table uses for Ms Alder. The platform matches a value exactly, as written. Before confirming, Adeyemi presses a button to check how many rows match. The answer is a count and nothing else: the rows are not shown, and a value that matches no row would be listed by name, so that a mistyped id does not quietly produce an empty package.
Confirming starts a background job. It copies the files of the named datasets, checks each one against the fingerprint recorded when it was sealed, and writes them into one package that it signs and encrypts. For the filtered table it reads the table and keeps only the rows that match, and it includes nothing else of that table: not the original records, and not the copy of the table that holds every row. No person opens the package, and no platform administrator can, because the secret that opens it, called a passphrase, is held back for the custodian.
The passphrase is shown on this screen and nowhere else. The platform does not keep it after this, so it cannot be shown again and cannot be recovered. The custodian passes it to the recipient separately from the download link, so that holding the file alone is not enough to open it.
A platform administrator makes the download link
Delivery is a person’s act, because how a court or a law firm wants to receive a package is not the platform’s decision. The platform makes a package available and records every download.
A platform administrator never sees the records, but sees what is in the package. The list is called the manifest. It names every file and gives its size and a fingerprint of its contents, which is a value that changes if even one byte of the file changes. The platform signs the manifest, so any later change to a file or to the list can be noticed.
The link is shown once. It works three times and for seven days at most, and each use is written to the audit trail. The package is encrypted, so the link alone opens nothing. The recipient also needs the passphrase that only Adeyemi was given.
/legal-exports/download/mlx_, and the line Works 3 times until Oct 18, 2026. It is not shown again.The recipient opens the package
Ruth Aldous is a lawyer at the firm that is to receive the package. The platform has finished its part. Ruth has been sent the link and, separately, the passphrase, and works on Ruth’s own computer with a small program that comes with Munitas, open_legal_package.py. The program shares no code with the platform, so that the format of the package is the only thing the two have in common. What follows was recorded by running the real commands. The link and the passphrase are shown as placeholders here, because they are secrets.
The platform publishes the public half of its signing key. A public key lets anybody check a signature and lets nobody make one. Ruth asks for it directly from the platform, so that the check below does not rest on anything that came inside the package.
curl <the platform's address>/legal-exports/signing-keyWhat came back
{"algorithm":"ed25519","public_key":"2bdeb5795b70f451b6a0152fd0dc508a06eb522f1f6f23424e770c5652d3c238"}The first command saves the file the link hands over. The second decrypts it with the passphrase, unpacks it, and checks three things: the manifest’s signature against the platform’s key, every file against the size and fingerprint in the manifest, and that no file is present that the manifest does not list. Any failure makes the program say so and stop.
curl -o KB-2026-004411.mlep "<the download link>"What came back
(a file of 2372 bytes is saved, and nothing is printed)
python open_legal_package.py KB-2026-004411.mlep --out opened --public-key <the platform's public key> --passphrase <the passphrase>What came back
OK: 1 file for matter HC-2026-0417 (demand KB-2026-004411, produced 2026-10-10T19:03:29.245302+00:00). Signature verified.
Besides the one data file, the package holds the manifest and its signature, the chain of custody, the audit trail, and a list of records that no longer exist. The chain of custody is the record of who asked, who approved and who confirmed, and when, and for a filtered table it also names the values the custodian supplied. The audit trail is the list of who was allowed or refused what for the named dataset, as the demand asked.
audit-trail.csv 68 bytes chain-of-custody.json 1591 bytes data/appointments/v1/v1.filtered.csv 199 bytes erased.json 77 bytes manifest.json 1123 bytes manifest.sig 128 bytes
The clinic’s table has ten rows for five patients. The package holds the two that match the patient id the custodian named, with every column kept, and nothing about the other four patients. The platform does not decide what is private or privileged beyond that. It copies the matching rows exactly, and the manifest records how the file was made: the column, how many values were named, how many rows matched out of how many, and the fingerprint of the sealed records they were taken from.
"appointment_id","patient_id","patient_name","appointment_on","reason" "A-0001","P-4471","Ms Alder","2026-03-04","Follow-up consultation" "A-0004","P-4471","Ms Alder","2026-04-09","Procedure review"