One record. Every answer.

01

A trail that cannot be rewritten

Each action is normalised into one shape, sealed with a keyed SHA-256 hash, and chained to the entry before it. There is no update or delete path on the audit table for any role the application can reach, including administrators.So thatYou can say the record has not changed since it was written, and show why that is structurally true rather than asking to be believed.

02

Every agent in one register

Agents are registered with what they can reach and how much autonomy they hold. The risk rating is computed by a database trigger from those two inputs, so it cannot be talked down by whoever filled in the form.So thatThe first question in every security questionnaire, what AI do you run, has an answer that is current by construction.

03

Misuse and data-leak alerts

The ingest path watches for unusual volumes of sensitive-data access, unregistered agents touching protected data, and repeated failures. Each alert is attributed to the person who triggered the action, not to the integration.So thatShadow AI surfaces as an alert with a name against it, instead of as a surprise during an audit.

04

Human review, on the record

Reviewers record their decision against the specific action they reviewed, with their identity and a timestamp. Oversight records are append-only for the same reason the trail is.So thatYou have the artefact EU AI Act Article 14 asks for, rather than a claim that review happens.

05

Secrets stopped at the door

Credentials, card numbers, and personal identifiers are recognised and stripped before an entry is written, on the client and again on the server. An append-only table cannot un-write a secret, so the only safe place to catch one is on the way in.So thatAn agent that logs an API key once does not put it in your compliance record forever.

06

Evidence on demand

The binder is generated from the actual trail: inventory, oversight records, the framework mapping, and an index of every sealed record in scope, with a signed checkpoint anyone can verify offline. It is not a summary someone assembled by hand the week before the audit.So thatAnswering an assessor takes a click rather than three weeks of reconstruction.

1. 1

   Connect a source

   Add one HTTP step to a Make.com or n8n scenario, or a few lines to your own code. Nothing about your workflows changes.

2. 2

   Records seal themselves

   Each action is normalised, sealed with a keyed SHA-256 hash, and chained to the entry before it. Nobody is asked to remember to log anything.

3. 3

   Hand over the evidence

   Export a formatted binder for an auditor, an insurer, or a customer's security review. It reads from the real record, not a summary.

How it maps to frameworks →