Independent proofs of integrity and provenance for digital archives.

The institution designates a Signing Officer — typically a senior archivist, collection manager, or director — who holds the hardware key and reviews batches in the portal when notified. The role requires no technical background. Beyond the Signing Officer, IT involvement is limited to the initial integration, which is designed and implemented by GAMI.

Hashes are read directly from the preservation system, which in most cases has already computed them during ingest. Where they are not pre-computed, GAMI's tooling runs locally on institutional infrastructure or on a server provided by the institution and computes them in place. Source files are never transmitted; only 64-character hash strings and associated metadata are sent to GAMI. The integration approach is agreed and documented before work begins.

Yes. The GPR construction pipeline is open source and can run locally on institution-controlled infrastructure. GAMI can deploy and configure the tooling within the institutional environment; GPR drafts are then transmitted only at the signing stage. This model is available on request and suits institutions with strict data-governance requirements.

Loss or retirement of a key does not affect previously anchored records. Each GPR carries the signature made under the key at the time of signing, and its validity rests on the OpenTimestamps timestamp regardless of the key's current status. For future signing, the institution generates a new key pair on a replacement device, publishes the updated public key in its DID document, and continues anchoring. A backup Signing Officer with a secondary device is recommended from the outset.

No. GAMI is a post-ingestion layer that reads outputs already produced by the preservation system. It does not write to, modify, or integrate with the archival management system, and the preservation workflow itself is unchanged. Integration has been validated with Archivematica, Preservica, ArchivesSpace, AToM, and unmanaged filesystems; custom adapter development is available for other systems.

As new material is ingested through the standard workflow, the integration detects new records and prepares GPR drafts. Drafts accumulate until the next signing session. At an interval set by the institution — daily, weekly, or monthly — the Signing Officer receives an email, opens the portal, reviews the batch, and signs with the hardware key. The interaction typically takes a few minutes. Blockchain anchoring proceeds automatically; confirmation appears in the portal, and GPR files are returned for local storage.

Anchored GPRs remain valid and verifiable. The blockchain anchor is maintained by the Bitcoin network and is independent of any single organisation. The institution holds the GPR files, the open-source tooling, the signing key, and the DID document needed for independent verification, and the verification process can be reproduced offline using published standards. The GAMI index supports discoverability, not validity — the relationship is comparable to that between a library catalogue and the documents it describes.

Pilot costs are partially or fully covered by GAMI through grant and foundation funding. The structure of ongoing costs is discussed openly during the pilot. Institutions whose circumstances do not support the standard fee structure — in particular smaller memorial sites and archives with constrained operating budgets — are encouraged to raise this in the initial conversation. Co-funded arrangements, joint grant applications, and adjusted terms are available where appropriate.