Cryptographic method to certify retention lock status for auditing in a backup system

A system for certifying retention lock status for a file stored in a storage target of a backup system, comprising:

• memory of the storage target storing the file in the backup system and subject to one or more compliance standards regarding storage and protection of data including the file;
• a storage target applying a retention lock (RL) on the file to define a RL status, wherein the RL status is configured to contain metadata comprising a name and full path for the file, mtime for the file, a checksum for the file and checksum algorithm, and the RL status;
• a generator generating the RL status as cleartext in the storage target;
• a hardware-based encryption component encrypting the RL status using an encryption key process encrypting the cleartext to create a token encoding the RL status to generate an encrypted RL status;
• a token generator generating the token encoding the RL status through a process comprising one of hashing the cleartext and encrypting the hash using a filesystem private key, or encrypting the cleartext using the filesystem private key:
• an interface transmitting the token to a backup server of the backup system;
• and
• the backup software storing the token to thereby make the RL status available for inspection and audit in response to a request to verify compliance with the one or more compliance standards.