Regulatory & compliance

Designed for regulated environments: enforce human oversight by policy and produce cryptographically verifiable evidence.

Policy-enforced human review

Mandatory review is triggered automatically when confidence is below thresholds, evidence is missing, or fields are null.

Append-only audit trail

Every event is written to audit.jsonl with timestamps, action type, and structured payload.

Evidence capture

Screenshots and artifacts are retained alongside events for independent review.

Signed evidence packs

Audit exports include SHA-256 hashes and Ed25519 signatures over the manifest.

Customer-owned keys

Production signing uses customer-owned keys (AWS KMS default; Azure/GCP supported). Offline verification is supported.