A standard for holding stories · Australia
How a story is held
Version 1, draft. Not yet published. Next review one year from publication. Measured against Empathy Ledger on 6 September 2026. Contact: not yet named (see clause 10). Co-signatories: none yet. Each will be listed here against the version they signed.
Written to the ruled outline in docs/decisions/2026-09-06-what-version-1-of-how-a-story-is-held-says.md. Every decision in this document was made there. Nothing here is the writer's.
Can the person whose story it is see every use of it, and stop any of them, today?
Ask the platform to show one person everything it holds about them, and to take it down. Time both.
That is the criterion, and the test that proves it. Everything below is the criterion read slowly, clause by clause, with the test each clause can be held to.
Empathy Ledger answers it one way: a story is one record, held once, in Sydney, under the name of the person who told it. Everyone else holds a door to it. Every door asks the record, before it opens, whether this person's permission is live for this reader, for this use, today. That is one architecture. The clauses are written so a platform built differently can be held to them too.
Ten clauses, and where this platform stands against each
Left, what anyone holding stories must do. Right, what Empathy Ledger does today, measured by running something rather than by reading the code that was meant to do it. Two words per clause: Implemented or In progress. Where a clause has two parts and they differ, both words appear and the parts are named. Every grade was measured on 6 September 2026 against the production database, by running something. The instruments are named in docs/strategy/how-a-story-is-held.md and live in the repository beside this document.
The consent record
A consent record names the person, the item and the medium, the audience and the purpose, the channel it came through, its state, a review date, and who gave it on what authority.
The last field is the one this document exists for. ISO/IEC TS 27560 records the principal's own consent. The Kantara receipt carries one principal identifier. The Data Privacy Vocabulary has no state for waiting on somebody else's authority. In Australia a story is often given by a family, a community or an elder speaking for material that is theirs to speak for, and a record that cannot say so is a record of the wrong thing.
9 of 315 active consents name who gave them. 0 carry a review date.
Cultural instruction
Material marked secret or sacred is never served, by any default. Only a named person holding authority can change the marking. A cultural instruction is a row with an author, a basis and a date, never a boolean. It attaches to the person and propagates to every item that shows them.
Holding is permitted where a community has asked for it. A community may ask a platform to keep something it must never serve, and a document that forbids that is the platform deciding on the community's behalf.
3 items are marked never to publish. 0 cultural exemptions are on file, so every public photograph of a person requires an authority and fails closed without one. 21 elder attachments hold. There is no cascade on a death, and no Local Contexts Labels.
Withdrawal
A withdrawal is a new record. It deletes no history. It is immediate for anything the platform serves. For a recipient that caches, the document states the time that recipient has stated. Where a recipient has stated none, the document names the recipient and says no time can be promised.
3 of 10 active partners have never stated whether they cache. 2 of 121 approved grants on active partners sit with one that has stated no mode, so no time can be promised there.
Portability
The export carries everything held about the person, and where anything is withheld the export names it and the reason.
These two halves are one clause. The first alone can never be checked. The second alone lets an adopter export nothing and simply say so.
The export carries 35 kinds of record about the person. Two kinds are withheld and named inside the export and here: the organisation's own structure, and counters of what other people did. The drill fails if a third appears.
Succession
A named successor custodian exists in writing before anything is held for that community: the community's own incorporated body where one exists, else an institution the community names, else a named person as an interim for at most twelve months. Never the holder itself, never a partner. Absent a written agreement, the claim to hold that community's material safely reads In progress, however long the platform has run.
The grading rule is CoreTrustSeal's. A spoken intention moves nothing.
0 of 30 organisations holding active people have a written successor agreement.
Repatriation
Partial repatriation is copies made available to the community while the platform keeps holding its own. Full repatriation is deletion: gone from the live database immediately, and gone from every backup within the backup window, which the document names. One exception is allowed, consented in writing, for a stated purpose and a stated period.
The definition is the Maori Data Governance Model's. Naming the window makes it a published fact, so shortening or lengthening it becomes a visible decision. As of 6 September 2026, Empathy Ledger's window is seven days.
Backups roll off in 7 days. No consented-exception mechanism exists.
Exit
A community leaves in this order: a request to leave, then full return within ninety days in a usable and where needed physical format, to the successor custodian the community named, then confirmed receipt in writing, then and only then any decommissioning. Nothing is decommissioned until the successor says it has what it was given; if no confirmation comes within twelve months the holder keeps holding and asks again. Return covers the records, the transcripts, what was derived from them, the consent history, the trace, and the register of where every copy went, so the community can also tell each partner. Backups are deleted within the stated window and the deletion is recorded as an event the community can see.
The sequence and its times are written (ruled 6 September 2026). No community has yet signed one.
Measurement
The person sees their own trace before anyone else. The community sees its aggregate before any funder. Counts include refusals, withdrawals, stories held back and conversations still owed. Nobody is ranked.
Every measurement product read for this document reports to the organiser. This clause is what separates the document from all of them, and it stays a must for that reason.
The use-and-return ledger is read by the person first. The community aggregate at /org/<slug>/report/state is public, so a funder reads it the same moment the community does.
Verification
The checks ship as runnable code beside the standard, and a statement of what could not be verified is published with it.
This is what lets somebody who does not trust the author check every other grade. It is also what stops an adopter claiming compliance from a policy document.
Twelve promises each name a check that runs, four of them written on 5 September 2026 and each broken once on purpose before it was believed. The statement of what could not be verified is the next section of this document.
Accountability
A named person, a working address, acknowledgement within two business days and an answer within thirty, and a public line for each co-signatory saying which version they signed and whether it still stands.
Thirty days is the Privacy Act's own timeframe for an access request. Naming who, and where, is what keeps the channel alive after the launch.
Every email address published on the site was undeliverable when measured: empathyledger.org does not resolve, and empathyledger.com publishes no mail record. The privacy page offered a contact form that does not exist. No response time is stated anywhere. A repair moving every address to a deliverable one is in review and not yet live. Nobody is named.
Two clauses implemented, two split, six in progress. Publishing that is the point. A clause the author already meets creates no pressure, and the one most likely to be deferred forever, the successor agreements, is the one this table makes visible every time somebody reads it. The export's completeness was the other, until it was built on 6 September 2026; what it withholds is published beside this document, on the same page, from the same list every export carries.
What a person’s export does not carry
Clause 4 asks that anything withheld be named with its reason. This is the list, the same one printed as the last section of every export, ruled 2026-09-06. A check in the platform fails if a record about a person is ever kept out without appearing here.
The organisation's own structure
Which organisation you belong to is in your record; how that organisation runs itself is theirs.
organization members, organization roles, profile organizations, super admin permissions, storyteller dashboard config
Counters of what other people did
Counts of what other people did with your story, not anything about you; the totals appear in Where your words were used.
story engagement daily, story engagement events, storyteller analytics
What could not be verified
Clause 9 asks for this section. These are the claims in Part B that rest on something other than a check that ran.
Whether a partner without a receiver purges on withdrawal. Three of the ten active partners carry a signing secret and a receiver that answers. For the other seven, withdrawal works by refusal on their next read, and whether they hold a copy in the meantime is taken from what they have stated, or, for three of them, from nothing at all.
Whether a person is gone from a backup after seven days. The window is the provider's setting, read from the provider. No drill has yet deleted one person and then restored the oldest backup to show the row is absent.
Whether the photographs and recordings are backed up at all. The database dump holds the row that names a file and never the file. 8,693 storage objects are in no database backup, and point-in-time recovery is off. The restore drill proves the rows come back. It cannot prove the pictures do.
Whether a copy already out has been taken down. Four photographs are served by a partner from a database outside this platform's estate, where no withdrawal can reach. The accountability endpoint the partners hold a token for has recorded 0 events, so nothing they have published, reviewed or run a model over is known here except by asking them.
What this document never claims
- That a copy already out can be recalled. Nobody can. The honest design is a register of where each release went and a notice to each recipient, and the person is told this before they say yes.
- That this document has legal force. The Privacy Act gives access and correction. Erasure is proposed only against platforms above $500 million in turnover or 2.5 million users, and portability exists only in designated Consumer Data Right sectors.
- That a green check proves a platform is secure. A probe is one claim about one mechanism. The probe written on 5 September 2026 found what the probe written two days earlier could not see.
- That the platform holds any licence over a person's words. On withdrawal, the platform's right to hold and serve ends with it.
- That consent given once stands.
Co-signed by
A co-signature attaches to this version and this date. It is listed publicly, against the version signed, with whether it still stands. It commits the signatory to being measured against Part A the same way, and to the exit in clause 7 should they ever leave.
No co-signatory yet. Who signs, and what signing asks of them, is being decided.
Organisation, name, date.
Version history
| Version | Published | Next review | Change |
|---|---|---|---|
| 1 (draft) | not yet | one year from publication | First text, written to the outline ruled on 6 September 2026. |