Prisms & the Cloud Standard

A prism is a namespaced vault on the DataPrism decentralized network, dedicated to the index of your files (the reconstruction "routes"), not to the files themselves. The heavy data lives at your storage providers; the prism only holds lightweight, encrypted, tamper-proof metadata that nobody can alter or delete without your key.

Identity

A DataPrism identity is an account address. Two entry points:

Existing account: connect a compatible account extension (MetaMask, Coinbase Wallet, and others) through your application; the SDK builds on viem, so any viem WalletClient works.
Prism Key: for users without one, a key can be generated for them. The user never has to understand the underlying network.

That address serves as identity (prism ownership, request signatures), as the destination for purchased credits, and, crucially, as the source of the encryption key (see dataprism.key below).

Identifiers: protocolId & cloudId

Each prism has a 32-byte identifier, the protocolId, derived deterministically from the platform address and a caller-chosen salt. At the application layer a shortened cloudId (16 bytes, the first half of the protocolId) is used to keep records small.

Because the derivation is deterministic, the SDK can compute the cloudId offline with computeCloudId(address, salt). This is what lets a prism created through the delegated (fee-free) path know its ID immediately, without waiting for the relayer's confirmation.

Creating a prism

Creation goes through the SDK. Two paths, depending on whether the user holds the network's fee currency:

            ┌────── can the user pay network fees? ─────┐
            │ YES                                   NO  │
            ▼                                           ▼
   direct network call                    request to the DataPrism API,
   the user pays the fees                 signed by the user (typed signature)
            │                                           │
            │                             a relayer executes the operation
            │                             and fronts the fees
            ▼                                           ▼
      prism created on the network ◄────────────────────┘

The SDK's execution layer makes both paths transparent: the calling code is identical. At creation, a prism is provisioned with a set of standardized data slots.

When a prism is created with an initial balance (fundAmount > 0), funding and creation happen in a single operation: the SDK has the user sign a token permit (a free, offline signature) instead of a separate approval step, and the platform applies both at once. Creation can also write an initial batch of data in the same atomic operation, so a prism is created and populated in one signature. In the SDK this is the default behaviour of PrismManager.create(): it provisions the prism and writes the standard slots (key, encryption, metadata, providers) in one operation.

The Cloud Standard

The Cloud Standard is a naming convention for the reserved slots of a prism. Each slot is identified by a dataId, the hash of its name. The stored value is always JSON serialized to bytes, and it is encrypted unless noted otherwise.

Slot	`dataId`	Encrypted?	Holds
`dataprism.key`	`hash("dataprism.key")`	clear	the prism's public key
`dataprism.encryption`	`hash("dataprism.encryption")`	clear	curve and algorithm
`dataprism.metadata`	`hash("dataprism.metadata")`	sealed	name, description, member addresses
`dataprism.providers`	`hash("dataprism.providers")`	sealed	non-secret storage locations and signer URLs
file index	`hash(filename)`	sealed	per-file reconstruction root

`dataprism.key`

{ "public": "", "private": "" }

public: the prism's public key. Readable by anyone (it is used to encrypt for the prism), so this slot is stored in clear.
private: the private key. Empty by default and never written to the network.

The private key is not stored anywhere. It is derived on demand, client-side, from a signature:

   connected account
        │  the user signs a deterministic message:
        │     • dataprism:key:${cloudId}              (default)
        │     • dataprism:key:${cloudId}:${password}  (extra security)
        ▼
   signature (deterministic)
        ▼
   = private key used by the SDK
        ▼
   public key derived → written into dataprism.key.public

Why the cloudId? It is public and known from the prism's id, so the key is reproducible from the prism alone; there is no per-prism secret to store. Why the optional password? Deriving from the cloudId alone means anyone who steals the account's private key could reproduce the signature and decrypt. Adding a password makes it a second factor: decryption then also requires the password, which is never stored, only mixed into the signed message.

The exact signed message is dataprism:key:${cloudId} (default) or dataprism:key:${cloudId}:${password} (with a password). The same message must be used at creation and on every read, or the derived key will not match.

`dataprism.encryption`

{ "curve": "secp256k1", "algorithm": "aes-256-gcm" }

curve: "secp256k1" | "x25519" | "ed25519"
algorithm: "aes-256-gcm" | "xchacha20"

These parameters define how the key encrypts and decrypts everything else (metadata, providers, file indexes). Stored in clear so a reader knows how to decrypt the rest.

`dataprism.metadata`

{
  "name": "",
  "description": "",
  "addresses": { "0x...": "human-readable name" }
}

name, description: prism information.
addresses: the authorized owner and writer addresses, each mapped to a readable name.

This JSON is sealed with the parameters from dataprism.encryption.

`dataprism.providers`

A sealed JSON keyed by provider ID. It records the non-secret location of each customer-owned store and the customer-controlled endpoint that issues short-lived, object-scoped URLs.

{
  "aws_s3": {
    "service": "signed_url",
    "signerUrl": "https://storage.example.com/aws/sign",
    "region": "eu-west-1",
    "bucket": "acme-dataprism"
  },
  "cloudflare_r2": {
    "service": "signed_url",
    "signerUrl": "https://storage.example.com/r2/sign",
    "endpoint": "https://account-id.r2.cloudflarestorage.com",
    "bucket": "acme-dataprism-r2",
    "region": "auto"
  }
}

File index slots

In addition to the reserved slots above, each uploaded file creates a slot whose dataId is the hashed filename. Its value is the sealed JSON of the root reconstruction index: quorum, provider list, and a Merkle root that points to the chunks and manifests stored at the providers. This root stays tiny, a few hundred bytes, regardless of file size. See File storage & resilience.

Working with prisms in code

The SDK turns these concepts into a typed API: CloudStandard encodes and seals each slot, CloudReader reads and decrypts in one step, and PrismManager handles single-operation creation plus dedicated slot editors with a guard against overwriting reserved slots. See Cloud Standard slots.