Use case / Compliance evidence

Hand the assessor the record they actually asked for.
Not a data dump to interpret.

Raw logs aren't evidence. A signed, timestamped, attributable record that maps to a named requirement is — the 17a-4 audit-trail alternative, the HIPAA 164.312(b) record, the EU AI Act Article 12 log, produced in the form an assessor recognizes.

SEC 17a-4HIPAA 164.312(b)EU AI Act Art. 12self-authenticating

Book an agent audit See the evidence ↓

The artifact, not the export · verifiable by anyone

Compliance record · live

RequirementSEC 17a-4 alternative

Maps toHIPAA 164.312(b)

Maps toEU AI Act Art. 12

Attributedagent + authorizing human

signed in-process · time-stamped · anchored Rekor

✓ self-authenticating · FRE 902(13)–(14)

01The stakes

request · evidence for control 7.2

The assessor asked for one specific record. You sent a 40,000-line log export.

Raw logs put the interpreting on the assessor and slow the whole review. AIR produces the exact artifact — signed, timestamped, attributable, mapped to the named requirement — so what you hand over is evidence, not homework.

02What counts

A log is not evidence. This is.

Signed, not just stored

tamper-evident

A record signed in-process and anchored is tamper-evident. A log anyone on the team could edit is not.

BLAKE3 content hash, Ed25519 signature, public anchor.

Attributable

who, and under whose authority

Each record names the agent, the action, and the human who authorized it. "Someone did something" doesn't pass.

Bound to a named human via Auth0, Entra, Okta or SPIFFE.

Mapped to the requirement

the assessor's clause

Each record points at the named clause — 17a-4, HIPAA 164.312(b), EU AI Act Art. 12 — so the assessor sees the answer.

The form they recognize, not raw data to interpret.

03How AIR answers

Everything that turns a log into evidence.

Is this the record the requirement asks for?

ProveEach record maps to the named clause it satisfies.

Can you prove it wasn't edited?

ProveBLAKE3 + Ed25519, anchored to a public transparency log.

Who and what did it?

AccountThe agent and the authorizing human, on every record.

Will it hold outside our walls?

AdmissibleSelf-authenticating under FRE 902(13)–(14).

For 17a-4, HIPAA and the EU AI Act at once?

One recordOne record, mapped to each requirement.

04The evidence

This is the artifact, not the export.

A signed, timestamped, attributable record that maps to the exact requirement the assessor cited — independently verifiable, with zero Vindicara infrastructure in the path.

See the full evidence model →

Compliance record · agdr/v2

Requirement · SEC 17a-4 audit-trail alternative

Action · agent action — time-stamped, attributed

Maps to · HIPAA 164.312(b) · EU AI Act Art. 12

signed in-process · blake3 · ed25519 · anchored Rekor

✓ self-authenticating · FRE 902(13)–(14)

05What you get

The tiers compliance teams choose.

Enterprise

most teams here

Signed, attributable, requirement-mapped records
Framework reports — SOC 2 · HIPAA · ISO 42001 · EU AI Act
Causal graph, query & replay
SIEM: Splunk · Datadog · Sentinel · Sumo
Retention to your regulatory floor

Book an agent audit

Air-gapped

regulated · sovereign

Everything in Enterprise, plus

On-prem / offline anchoring
No phone-home — records never leave
Extended retention + PQ re-anchoring
Admissibility Pack — FRE 902 + expert support

Talk to us

Send evidence, not a data dump.

A free agent audit shows the exact records you could hand an assessor today — and which requirements they already satisfy.

Book an agent audit →