Six industries, one buyer: someone personally liable for output an assistant touched, who cannot currently reconstruct what the assistant actually said.
That you cannot show what it said. A figure went into a memo, the memo went to a client, and six months later nobody can reconstruct where the figure came from — whether the assistant produced it, whether it was checked, whether it was flagged and overridden. You carry that. The tool you used carries nothing.
And the quieter one: that a document you pasted was carrying an instruction. A contract with a line addressed to the assistant. It happens now, it is invisible in the answer, and no existing control catches it.
Privilege review, production, research. Designations get challenged and the exposure lands on a named partner. Professional conduct rules already speak to supervision and candour.
Model risk management already expects independent validation, and record retention rules already exist. The concept needs no explaining.
Reconciliation, sampling, close. Peer review asks whether work was performed with due care, and an auditor asks how a figure was derived.
Prior authorisation, coding, intake. A payer audit asks how a determination was reached, long after it was.
Calculations, specifications, drawing review. A licensed engineer stamps the work and the duty does not transfer to a tool.
Pre-trade checks, screening, reconciliation. Questions arrive in days and the amounts are large.
Two of these lead with you are already required to. Four lead with you are personally exposed. That is the opening line, not the product.
A stated total that does not equal its stated parts, recomputed exactly rather than estimated. A figure that was never computed has nothing holding its parts together.
The misquote that matters is the right digits credited to your document and absent from it, or a value that does not match it.
The one check that gets past a coherent error, because the broker's record of a tool call is outside the model's account.
A CUSIP, ISIN or IBAN carries a check digit. A fabricated one is not hard to find — it is arithmetically impossible.
Your reference data, curated by your people. A finding never says you are wrong: it says what disagrees, from where, and that the reference may be the stale one.
A figure passed into a tool call, in the deliverable, or copied by someone is a different problem from the same figure in scratch reasoning. Findings are ranked by that. And irreversible actions are held mid-run. A payment, a filing, a send — pattern-classified, scanned for instructions that arrived inside pasted documents, and pended until your firm's policy answers. Review after the fact is a record; a hold before the act is a control.
The hold is recorded in the trace as a decision step, so a held action and an overridden one are both part of the record. And the record checks the agent's own account of what left the building, both ways — an irreversible call it performed and did not declare, and a declared action no step ever performed. Over-declaring is not the safe direction either: a reviewer reads that field to decide whether anything reached outside, and the blast-radius report is computed from it. [In development: the same gate aimed at output generally — run, review, decision, then send.]
The gate holds and discloses; it never rewrites. The moment a verification layer edits an output it becomes a second author, and both your liability position and our measurement are gone.
Records are sealed on your machines, under a key your firm holds. We keep no copy — there is no server of ours for your records to be on. The only calls that leave go to the model vendors you already use, on your own keys: the proxy forwards the calls your people were already making, unchanged. A network audit generated from the code lists every module that can reach the network and what each one sends.
Every network claim ships in a supply-chain document beside the code, and a checker verifies each claim against the module that makes it — failing the build if one is quietly broken. The same mechanism that publishes our welfare floor publishes this one.
One consequence worth stating plainly: we cannot be subpoenaed for your records, because we do not have them. A vendor that holds your logs in their cloud can be compelled to produce them without you in the room. There is nothing of yours here to produce.
Every record is encrypted under its own key and sealed into a hash chain you can anchor outside the store. Change one byte and verification says which record, and where.
The store's key can be held by your firm's own key manager, so your people, your roles and your revocation decide who opens it — not us. [In development: the connection to your key manager is built for the one you name, and tested against it, before we claim it.]
A re-key ceremony moves every record under a new key and destroys the old one only after every record reads back. Anyone who held the old key can no longer open the store. Killed mid-run at five points in testing, it lost nothing.
Every package we ship is checked against the public vulnerability database before release. The first scan found five advisories in a package we had pinned. The pin moved the same day, and the rescan is clean.
Our supply-chain document makes 52 claims about what the code does and does not do. A checker verifies each one against the code and fails the build if one breaks.
Every read, export and deletion lands in its own tamper-evident access log. Legal holds block deletion. A deleted record leaves a permanent tombstone proving it existed.
What we do not have yet, said before you ask: no outside penetration test and no third-party review of the cryptography. Those need someone who is not us, and the security and AI-governance evidence packs name them as gaps.
One command turns your sealed records into an evidence pack for thirteen frameworks. Views written to each profession's own rules: law (ABA Formal Opinion 512), audit (PCAOB AS 1215 and AICPA AU-C 230), healthcare (the HIPAA Security Rule), broker-dealers (FINRA and SEC Rule 17a-4), bank model risk, and education (FERPA). Plus EU AI Act Articles 12 and 14, SOC 2 security, ISO/IEC 27001, ISO/IEC 42001 and the NIST AI Risk Management Framework.
Each requirement sits beside the mechanism that addresses it and the numbers from your own store. Nothing is marked met because we say so: record integrity, retention, access logging, key rotation and the dependency scan are evidenced from your store and our release. Where your records hold nothing relevant yet, the pack says so. Where a requirement is a policy your firm has to write, it says that too. Where a control could be built in and is not yet, it names the gap.
What our evidence packs
cover, framework by framework (PDF)
Compliance
and governance: where we stand, and what comes next (PDF)
This is alignment, not certification. The pack says so on page one: it is not a legal opinion and not a substitute for counsel. No NIST certification exists, so we will not claim one.
The trivial level — an answer that contradicts itself — is what these checks compute, so it is caught by construction. Above it, we planted errors at three levels of coherence: eight cases in all, four of them clean. The free checks caught none of the planted errors and flagged nothing clean. Eight is a small corpus, and we would rather say so before you ask — but the result lands where theory says it must: every free check is consistency detection, and a coherent error is consistent with itself. That boundary is why the layers above exist: the broker's record of what a tool actually returned, and a reviewer holding evidence the author does not control — structured on the measurement on our front page: the reviewing instance is never told the work is its own, because that framing alone is worth 20 to 89 points of detection on eight of the nine models we measured.
The hardest case is a false premise carried correctly — a wrong contract size with every figure downstream computed correctly from it. The arithmetic verifies. Nothing free reaches that, and a vendor telling a compliance officer otherwise is telling them something they know is false.
The browser layer also needs ongoing maintenance: the selectors belong to other companies and change without notice. They are built to degrade to no capture rather than a wrong one — but that is a support commitment, and you should hear it before you ask.