Skip to content
Orpyca

Rule by rule, with the real status

Public records management in Colombia is not a design preference: it is a legal obligation carrying sanctions. Orpyca was built by reading those rules and translating them into system behaviour.

This table states what each rule requires and what Orpyca does about it. Where something is implemented with a caveat, the caveat is written down. We would rather an institution knew exactly where it stands before signing a contract, not after.

Law 594 of 2000

General Archives Act

Implemented
What it requires
Document life cycle stages, mandatory retention schedule, integrity, authenticity and accessibility, accountable custodians, transfers and export of case files.
What Orpyca does
The full life cycle lives in the system: registration, processing, case file, two-phase retention and final disposition. Export delivers the case file with SHA-256 integrity verification.

AGN Agreement 001 of 2024

Single Agreement on the Archival Function

Implemented
What it requires
The rule currently in force, superseding thirty-one earlier agreements. It requires electronic pagination, a signed electronic index at case file closure, closure rules, absolute prohibitions and the single inventory format annex.
What Orpyca does
The electronic index is an append-only versioned XML with a per-document digest, signed in XAdES format when the case file closes. The result is placed under write-lock with retention derived from the retention schedule itself.

AGN Agreement 060 of 2001

Registration of official correspondence

Implemented
What it requires
A unique, consecutive and immutable number for official correspondence, with the minimum registration data.
What Orpyca does
The sequence is assigned atomically and the number never changes. It survives export and import between systems: the record keeps its identity as it travels.

Decree 1080 of 2015

consolidating Decree 2609 of 2012

Implemented
What it requires
The eight minimum records management processes, the four qualities of the electronic document (stable content, fixed form, archival bond and functional equivalence), immutability and metadata in three categories.
What Orpyca does
Document versioning, metadata structured by category, long-term archival formats and a hash-chained audit trail that no user can alter.

AGN Agreement 003 of 2015

Institutional Archives Plan

Implemented
What it requires
Institutional Archives Plan: diagnosis, critical aspects, articulating axes, prioritisation, road map and follow-up.
What Orpyca does
The plan is a module of the system, not a loose word-processor file. It follows the AGN six-step method, prioritises deterministically, versions the plan, records follow-up without allowing deletions and evidences the administrative act that approves it.

AGN Agreement 042 of 2002

Single Documentary Inventory Format

Implemented
What it requires
A documentary inventory with identified responsibilities: who prepared, delivered and received it.
What Orpyca does
The transfer record is immutable and carries the three personal signatures plus the institutional seal. The physical archive inventory is produced from the same system.

AGN Agreement 004 of 2019

Updating retention and appraisal schedules

Implemented
What it requires
Preparation and updating of retention and documentary appraisal schedules.
What Orpyca does
Hierarchical classification scheme and retention schedule, with two-phase retention and final disposition following AGN criteria.

AGN Agreement 006 of 2014

Digitisation for evidentiary purposes

Implemented
What it requires
Integrity verification of digitised documents.
What Orpyca does
Every stored object carries its SHA-256 checksum, recalculated when read and when packaged for preservation.

Law 527 of 1999 and signature decrees

Decrees 333 of 2014, 526 of 2021 and Decree 1074 of 2015, chapters 47 and 48

Implemented with a caveat
What it requires
Electronic and digital signature with functional equivalence, appropriate reliability, signatory obligations, certificate status validation and time stamping.
What Orpyca does
Native electronic signature (digest, identity and timestamp) and advanced signature in XAdES-B, T, LT and LTA formats, with RFC 3161 time stamping and validation through OCSP and revocation lists. The act of signing requires a second factor: a code by email or a one-time application.

Caveat

What the system produces is an electronic signature under article 7 of Law 527, not a qualified digital signature under article 28. Three concrete reasons: the certification authority, the time stamping authority and the online validation service shipped with it are local and NOT accredited before ONAC; keys are held on the server, so there is no sole control by the signatory and non-repudiation is not enforceable against the system operator; and there is no hardware security module. Full evidentiary effect requires connecting an accredited certification authority. The system declares this condition on every signature, in an explicit field, rather than feigning a status it does not have.

Law 1712 of 2014

Transparency and access to public information

Implemented
What it requires
Classification of information as public, classified or restricted, and publication of the index of classified and restricted information.
What Orpyca does
Every document carries its security level and the system applies clearance-based access control: nobody reads above their level or writes downwards. The index of classified and restricted information is generated from the system and does not disclose the content it protects.

Law 1755 of 2015

Right of petition

Implemented
What it requires
Handling of petitions, complaints, claims, suggestions and reports within statutory deadlines.
What Orpyca does
A dedicated workflow with working-day control based on the institution’s own calendar, expiry alerts and public look-up by verification code.

Law 1581 of 2012

Habeas data

Implemented
What it requires
Protection of personal data and data minimisation.
What Orpyca does
Personal data tied to revoked credentials is purged, and the system does not retain private signing material beyond its validity.

State Interoperability Framework and MIPG

MinTIC

Implemented
What it requires
Information exchange using open standards, look-up services and standardised archival description.
What Orpyca does
Metadata harvesting over OAI-PMH with Dublin Core and EAD archival description conforming to ISAD(G) and the Colombian technical standard; a CMIS read profile; package export and import with a published JSON schema; and outbound HMAC-signed webhooks.

ISO 14721 (OAIS), ISO 16363 and NTC-ISO 15489

Long-term digital preservation

Implemented with a caveat
What it requires
A trustworthy digital repository with archival packages, preservation metadata and integrity verification over time.
What Orpyca does
Archival packages in BagIt format carrying the real bytes with recalculated fixity, PREMIS metadata validated against the official Library of Congress schema, long-term format validation with veraPDF and package replication.

Caveat

It implements the practices those standards require, but Orpyca is not an accredited digital repository and does not certify the institution as one: ISO 16363 certification is granted to an institution after an audit, not to a piece of software. The package replica is also local, to a second store on the same infrastructure; an off-site copy is infrastructure work the institution must set up separately.

Physical archive management

operational complements

On the roadmap
What it requires
Labelling of storage units, repository capacity control and third-party custody.
What Orpyca does
Locations, units, shelf marks, loans and inventory already work. The printable QR label, repository occupancy control and external custody are under development.

Orpyca implements requirements derived from this framework, but no software can guarantee an institution’s legal conformity on its own: that also depends on its archival instruments, its procedures and its administrative acts. We recommend obtaining your own legal opinion before going into production.