Stage 1 of 7
An event happens.
An AI agent does something consequential: an LLM call, a tool call, a payment. The raw event enters the ledger the moment it occurs.
Evidence infrastructure for AI agents
When your AI agent's actions are questioned, "trust our logs" is not an answer.
TruthLayer seals every agent event into a tamper-evident, Bitcoin-anchored ledger. EvidenceVault turns sealed evidence into portable, post-quantum-signed certificates. Any regulator, court, auditor, or counterparty verifies everything offline with free open-source tools. They never have to trust you, and they never have to trust us.
root 0000000000000000 · anchored
verify · offline
- 124,800 events sealed under 3x overload, zero server errors
- 1,096/1,096 certificates archival-conformant
- 22,888 events/sec peak ingest
- Verifiers public on PyPI + npm
The accountability gap nobody has closed
AI agents now call models, execute code, move money, and reach external services with limited human supervision. When one of those actions is disputed later, in litigation, in a regulatory audit, in an insurance claim, or across a commercial boundary, the operator has only its own application logs.
Those logs fail at exactly the moment they matter. They can be edited, reordered, back-dated, or quietly deleted by the party they are supposed to hold accountable. A record the operator alone controls carries no weight with anyone who has a reason to doubt it.
The EU AI Act Article 12 already requires tamper-evident automatic logging for high-risk systems. Insurers, auditors, and counterparties need what your logging stack does not provide: proof of integrity, proof of existence in time from a party you do not control, and verification that works without trusting you.
| Ordinary logs | Write-once storage | TruthLayer + EvidenceVault |
|---|---|---|
| Operator can rewrite history | Operator still holds every key | Tampering is cryptographically detectable by anyone |
| Timestamps are self-asserted | Timestamps are self-asserted | Time attested by Bitcoin proof-of-work and an independent commercial TSA |
| Verification means trusting the operator | Verification means trusting the vendor | Verification is offline, open-source, and vendor-independent, forever |
How a moment becomes evidence
Follow one agent action from the instant it happens to the moment a stranger verifies it, years later, without trusting anyone. Scroll.
Stage 2 of 7
It becomes a fingerprint.
The event is canonicalized and hashed with SHA-256. The fingerprint identifies the exact bytes: change one character and the fingerprint changes completely.
same input, same hash, always. Different input, unrecognizably different hash.
Stage 3 of 7
Fingerprints form a chain.
Each event's hash includes the hash of the event before it. The chain has one direction. Edit, insert, delete, or reorder anything, and every link after it visibly breaks.
tampering is not prevented. It is unmissable.
Stage 4 of 7
The chain is sealed into a tree.
Each day, every hash in the chain becomes a leaf of a Merkle tree that reduces to a single root: one short fingerprint standing for the entire day, in order, complete.
Stage 5 of 7
The root is anchored beyond reach.
The root is timestamped by an independent commercial authority within seconds, and anchored into Bitcoin's proof-of-work within hours. From this moment, no one on earth, including us, can back-date or rewrite this day.
two independent clocks, neither of them ours.
Stage 6 of 7
Evidence becomes a certificate.
EvidenceVault re-derives the same root independently, then issues a portable certificate signed three times: Ed25519 for today, and two post-quantum schemes, ML-DSA-65 and SLH-DSA-SHA2-128f, for the decades a certificate must survive. All three must verify.
three signatures, two mathematical families. Breaking one is not enough.
Stage 7 of 7
A stranger verifies. Offline.
Years later, someone who distrusts everyone in this story installs a free open-source tool and checks it all: every link, the tree, the anchors, all three signatures. No account, no API, no us. The math either holds or it does not.
This is the difference between a log and evidence.
One agent action, made permanently checkable.
Measured in production, not projected
0events/sec
Peak ingest acceptance
Distributed test fleet, single-hop architecture.
0 / 0
Requests / failures
One tenant, 400 events/sec sustained for a full hour.
0server errors
Under 3x sustained overload
300,000 events offered at 500 req/s; every accepted event reconciled exactly against the sealed chain.
0 / 1,096
Certificates archival-conformant
Independent veraPDF validation, 146 rules, zero failures.
15 / 15
Daily seals verified offline
By the publicly installed verifier, signatures and roots recomputed.
DigiCert-proven
Independent timestamp chain
RFC 3161 sealed end to end against a commercial TSA in production.
Every number above comes from committed campaign evidence bundles, reproducible with published tooling. Three production bugs were found and fixed precisely because we measure live behaviour instead of asserting it. The methodology, including targets not yet met, is in the whitepaper.
Read the whitepaperDon't trust us. That's the point.
Every logging vendor asks you, and everyone who challenges you, to trust their platform. We built the opposite. The platform is proprietary; the verification is not.
The offline verifiers are MIT-licensed, published on public registries, and self-contained. A judge's clerk, an opposing expert witness, or a regulator's technical team can validate every signature, every chain link, every Merkle root, and every timestamp from public artifacts alone, with two commands, even if TruthLayer the company no longer exists.
This is also why the anomaly detection is a transparent weighted model with published weights rather than a black box: an expert witness can recompute any score by hand. Evidence that cannot be independently checked is not evidence. It is testimony.
pip install evidencevault-verify
evidencevault-verify --dir ./bundle --cert-id <cert_id> --tenant-id <tenant>Download a sample certificate bundle
exit 0 valid · exit 2 expired · exit 1 invalid
Limits
What this does not do
Tampering is detected, not prevented.
The chain makes an edit unmissable to anyone who checks. It does not stop an operator from attempting one.
Bitcoin anchoring is not instant.
The independent RFC 3161 timestamp lands in seconds; the proof-of-work anchor attaches within hours, or at issuance on the fast anchor add-on.
Evidence is only as good as what you seal.
TruthLayer proves what your agents reported and when. It cannot vouch for events your instrumentation never emitted.
The platform fails closed, visibly.
Dual-signed attestations are gated on verified professional licences. In our own campaigns the platform refused to issue an Attestation because no real licence was presented, and the refusal record is part of the evidence.
Not an observability replacement.
Observability tells you what your agents are doing. This proves to a hostile third party what they did.
Targets not yet met are published.
The whitepaper documents the full methodology, including the measurements that have not reached their target.
Built for the people who will challenge you
EU AI Act Article 12 audits
Tamper-evident automatic logs plus a corresponding Compliance Certificate, with a documented 48-hour response playbook. The regulator verifies everything offline, in two commands.
Audit and assurance
Evidence mapped to SOC 2, ISO 27001, and CPS 230 controls, deterministic sampling, and working-paper export to CaseWare, TeamMate, AuditBoard, and Wdesk formats. Dual-signed attestations are gated on verified professional licences and fail closed: in our own campaigns the platform refused to issue an Attestation because no real licence was presented. The refusal record is part of the evidence.
Insurance for agent activity
Coverage certificates bind policies to evidence by hash, with enforced predicate chains: a coverage certificate goes invalid the moment its underlying attestation is revoked. Deterministic, explainable risk scoring.
Litigation and legal hold
Custody certificates for chain-of-custody and deposition readiness, EDRM and Concordance e-discovery export, byte-reproducible artifacts, and a hand-recomputable anomaly model built for expert-witness scrutiny.
Small surface, serious cryptography
- Cloudflare-native
- Workers, Durable Objects, R2, Workflows; no servers to compromise, per-tenant isolation by construction.
- Hybrid signatures
- Ed25519 + ML-DSA-65 + SLH-DSA-SHA2-128f; all three must verify.
- Two-level key hierarchy
- Root keys certify short-lived 48-hour subkeys whose private halves never cross an RPC boundary.
- Transparency log
- Independent witnesses and a gossip monitor; two conflicting chain views cannot both become witnessed.
- Hash agility
- Dual-hash transition, SHA-256 + BLAKE3 robust combiner, Lamport one-time-signature floor.
- BYOK
- Per-tenant envelope encryption; Vault Transit keeps key material inside your KMS.
- Deployment
- Managed SaaS, dedicated single-tenant, on-premise on workerd, or fully air-gapped; verification works everywhere with zero network.
Simple tiers, priced on assurance
01
Diagnostic
Instrumenting agents and proving the model internally: ledger, seals, offline verification.
02
Evidentiary
Regulated deployments: higher ingest ceilings, certificates, registry, compliance workspaces.
03
Insurer-attested
Coverage-backed operations: unlimited ingest, predicate-enforced coverage certificates, priority anchoring.
04
Fast anchor add-on
Direct Bitcoin anchoring at issuance, immediate transaction id.
Verification is free for everyone, forever, by design.
Questions the technical reviewer will ask
The next dispute over an AI agent's actions is already scheduled. Choose what you'll be holding.
Start sealing agent activity this week, or begin by doing what your auditors will do: verify one of our certificates yourself, offline, right now.