Passkey Authentication Service  ·  View 11 of 21  ·  Data

Storage Zones by Rebuildability

Five zones, four of which can be lost and rebuilt, and the one that cannot.

Editable source SVG draw.io All views
Irreplaceable — losing a row locks a user out Credential store RPO 0, 480 GB Handle directory RPO 0 Tenant and RP-ID registry RPO 0, small Ephemeral — rebuilt by the user retrying Ceremony store TTL 300 s Velocity counters risk only Tenant config cache async refresh Derived — rebuildable from the stream ClickHouse hot store 13 months Coverage marts nightly Write-once — the evidence Audit stream Kafka, 7 days MinIO archive hash-chained segments Refreshed from upstream — never authored here Metadata snapshot signed, fail-static aggregate sealed segments Passkey Authentication Service — Storage Zones by Rebuildability Data store Queue / topic event / async batch Four of the five zones can be lost and rebuilt. The backup budget belongs almost entirely to the first zone, which is 480 GB of it. v 1.0 · owner Security & Identity Architecture · date 2026-10

Decisions

  • Zones are drawn by what losing them costs, not by technology. A lost ceremony record costs a retry; a lost credential record locks a human out of their account.
  • The irreplaceable zone carries RPO 0 and takes nearly the whole backup budget; the ephemeral zone is not backed up at all.
  • The evidence zone is write-once and hash-chained, so a gap is detectable rather than deniable.
  • The metadata snapshot is never authored here. It is refreshed from upstream and fails static on the last signed copy.

Assumptions

  • Credential store 480 GB; registry small enough that its RPO 0 is free.
  • Kafka retains 7 days, which is the window inside which a derived store can be rebuilt without touching the archive.
  • ClickHouse holds 13 months hot; MinIO holds 7 years in sealed, chained segments.

Risks

  • "Rebuildable" is only true if the rebuild is exercised. A derived store that has never been rebuilt from the stream is an assumption, not a property.
◀  Data Flow All views Data Model  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Security & Identity Architecture · 2026-1011-data-architecture