Archive
A finished letter is deposited with a number, a class and a retention period, and a fingerprint checked every night
In Zajil, deposit is an institutional act with an authority and a record, not a button that moves a letter to a folder. The letter or case file gets a number such as ARC-2026-000031, a class from the file plan, a retention period counted from its day, and one fingerprint for the body and another for the attachments.
- A ready file plan of eleven classes that the institution edits on screen
- SHA-256 fingerprints recomputed and compared every night, with every attachment file re-read
- Nothing expires or is destroyed automatically: expiry opens a review and a decision with a reason
The file plan
Every class has a retention period, a starting point, and what happens when it ends
This is the default plan as it ships with the installation. Classes form a coded tree, and a branch inherits its parent's period unless it sets its own.
- 01General correspondenceFrom the deposit date5 yearsReview
- 01.02CircularsFrom the deposit date3 yearsDestroy
- 01.03Internal memosFrom the deposit date3 yearsDestroy
- 02DecisionsKept permanentlyPermanentPermanent
- 03Contracts and agreementsFrom the last action10 yearsReview
- 04FinanceFrom the letter date10 yearsDestroy
- 05Human resourcesFrom the deposit date15 yearsReview
- 06Complaints and requestsFrom the deposit date5 yearsDestroy
- 07Reports and minutesFrom the deposit date7 yearsTransfer
- Retention is a snapshotIt is stored with each record at deposit. Changing the class later does not change what was already deposited.
- Three starting pointsThe deposit date, the letter date as in finance, or the last action as in contracts.
- Disable, never deleteA class in use is disabled, not deleted, so no record that points to it breaks.
- A separate authorityEditing the plan is its own authority in the roles, apart from depositing and reopening.
Deposit
A letter is deposited when it is finished, under authority, in one step
- Eligibility that states its reasonsA letter is not deposited while its status is open, or while it has an open routing or a pending approval. If deposit is refused, every reason is shown.
- One transactionThe number, class, retention, both fingerprints and the record are written together or not at all, and the letter is closed in the inbox of every recipient.
- Authority, not receiptDepositing for one's own unit and those below it is one authority; depositing for the whole institution and bulk deposit is another. "Done" in the inbox is a personal act that does not touch the archive.
- Physical location and cardsBuilding, room, shelf and box, and a printed card for the folder, for each sheet in it and for the storage box, with a code that leads to the record.
- Return to circulationWith a written reason and a higher authority, and only to an approved status. Depositing again creates a new record that points to the previous one.
Case files
A case's letters are deposited together under one number
A case file is a complete unit of deposit: one record for it, and a sub-record for each letter in it.
- 1
Collect the chain
A letter and everything linked to it are gathered into a case file in one step; internal memos are always left out to keep their seal.
- 2
Close under conditions
A case file cannot be closed while one of its letters awaits approval or review, or has a pending routing.
- 3
One number, with sub-numbers
The case file gets a number and each letter in it a sub-number such as ARC-2026-000031/01; the case file's fingerprint combines those of its letters.
- 4
It stays one unit
Extension, hold, reclassification and verification apply to the case file and its letters together.
Retention and disposition
When a period ends a review opens, and a person decides with a written reason
Zajil never destroys or transfers a letter automatically. Every night the records that reached the end of their retention are marked "for review", and the archivists receive one notice with the count.
- DepositedArchive number and class; retention is a snapshot on the record
- Retention runsFrom the deposit, the letter date or the last action
- Expired: for reviewA daily pass flags it, with one notice giving the count
- Decision with a reasonExtend, reclassify, or return to circulation
Legal holdStops retention from expiring, and any decision on the record, until it is lifted with a written reason.
- ExtendYears added with a reason, from the expiry date or from today if it has passed, and the record returns to deposited.
- ReclassifyTo another class with a reason and authority; retention is recomputed from the original deposit date.
- The set actionEach class has its action on expiry: review, destroy, transfer to the national archive, or permanent, and it shows on the record.
- A trace for every decisionEvery decision is an event in the archive log with its actor, time and reason, old and new side by side.
Integrity
What is in the archive is what was deposited, and that is checked every night
At deposit a fingerprint of the letter body and another of its attachments are stored. Every night the fingerprints are recomputed for a batch of the records checked longest ago, and their attachment files are read from storage and compared with what was deposited.
99cd3966…One fingerprint for allARC-2026-000008 · 2026-09-23- It reads files, not numbersThe check does not stop at comparing stored values: it re-reads every attachment file from storage and computes its fingerprint.
- An alert with the countA record that does not match is flagged, and the archivists get a notice with the number that failed and a filter to open them.
- A frozen identityA database trigger freezes the record's number and fingerprints and prevents its deletion, and its events are append-only.
- On demandA "Verify integrity now" button on the record page, with the result as an event in its log.
Archive center and search
One archive, searched in Arabic the way people type
- One centerAll deposit records on one screen, with filters for year, class, unit and status, and the archive in numbers beside them.
- Search across what identifies a recordThe deposit number, the letter number and subject, the case file number and title, the box and the notes.
- The archive does not widen visibilityStaff see in the archive what they can see among letters. The institution archivist sees every record card, while opening the letter itself stays under the letter's permissions.
- Reading is loggedOpening a deposit record logs a "retrieved for reading" event in its event log, under the name of whoever opened it.
- احمدأحمدHamza forms folded
- مدرسهمدرسةTaa marbuta and haa
- مسوولمسؤولHamza on waw
- ٢٠٢٦2026Arabic and Latin digits
Scanning
Paper goes from the scanner straight into the letter
A scan agent for Windows 10 and 11 works with scanners over WIA, so staff never save a file and upload it by hand.
- 1
From the scanner
The source is an explicit choice: feeder, flatbed or automatic. Automatic tries the tray and falls back to the glass if it is empty.
- 2
Pages counted live
Pages arrive one by one and the counter moves; an interrupted batch keeps what already arrived.
- 3
To where it belongs
The file is attached to the letter, the case file or the letter creation form, and passes the file inspector like any upload.
- 4
Verified updates
The agent takes its installer from the institution's own server and checks the SHA-256 fingerprint the server announces before running it.
Standards
Designed to support ISO 15489-1, with the status written clause by clause
- A standards page inside the archiveEach clause of ISO 15489-1 and ISO 30301, and control A.5.33 of ISO/IEC 27001, with its status: implemented, partial or gap, and how the archive meets it.
- Live evidenceCounts from the archive itself under each clause: active records, those verified in 90 days, those that did not match, and those under legal hold.
- What is not finished is written downPreserving storage media is the installation's responsibility, the actual destruction and transfer of letters are not built yet, and format conversion at deposit is a declared gap.
- For the auditorPDF and Excel export, with every export logged. This is design that supports the institution's compliance, not a certificate.
Frequently asked
About the Archive
Does Zajil destroy letters when their period ends?
No. Expiry marks the record "for review" and alerts the archivists, and the decision is theirs with a written reason: extend, reclassify or return to circulation. The actual destruction and transfer of letters are not built into the system yet.
What is the difference between "Done" in the inbox and deposit in the archive?
"Done" is a personal act that hides the letter from its owner's inbox only. Deposit is an institutional act under authority that gives the letter an archive number and closes it in every recipient's inbox.
What if an attachment file changes after deposit?
It shows at the first nightly check that reaches the record, or at once with the "Verify integrity now" button. The record is flagged as not matching, and the archivists are alerted.
Can we change the file plan?
Yes, on the file plan screen, for whoever holds that authority: new classes, periods, starting points and actions. What was deposited before the change keeps its period.
What about letters archived before the plan?
They received records in the "Unclassified" class with five years, and are reclassified with a reason and authority, which recomputes their retention.
A working build
Open the archive and try search and verification yourself
We review the file plan and retention periods with you before installation, and the institution starts with the default plan or its own.