Forensic-Grade Cryptographic Evidence

:: AI AUDIT EVIDENCE ::

Prove every AI decision.
No trust required.

Every input, output, and tool call is captured, SHA-256 hashed, ECDSA P-256 signed, and RFC 3161 timestamped. The evidence is independently verifiable — by your auditors, regulators, or anyone with the public key.

Start Free Trial How It Works

The Evidence Stack

What makes an audit record defensible?

Six layers of cryptographic integrity. Each one independently verifiable.

Content Integrity Hash

Every I/O payload is hashed with SHA-256 at the moment ViriSIM receives it. The hash certifies that the content has not been altered since capture.

SHA-256

Cryptographic Signature

The hash is signed using ECDSA P-256 with a Google Cloud KMS key. Anyone with the public key can verify the signature independently.

ECDSA P-256 · KMS

Trusted Timestamp

An RFC 3161 timestamp token proves the exact moment the evidence was captured. Timestamps are independently verifiable.

RFC 3161 · Sectigo

Hash-Chained Sessions

Every audit in a session is cryptographically linked to the previous one. Breaking the chain is detectable. Deleting a log creates a visible gap.

SHA-256 Chain

Customer-Held Keys

Your organization can provide its own ECDSA signature and signing key ID. The audit record includes both your signature and ViriSIM's — so verification is possible without relying solely on our infrastructure.

Customer KMS · Dual Signature

Full Audit Trail

Authorization chain, API key reference, session tracing, data residency, retention policy, and DPO documentation — all in one sealed record.

Complete Provenance

Sample Evidence

What an audit record looks like

This is what your auditors and regulators can verify independently.

A single sealed record contains:

Integrity Hash — SHA-256 over the exact I/O payload
Chain Hash — Links this record to the previous one in the session
ECDSA Signature — Signed by ViriSIM's KMS key (or yours)
RFC 3161 Timestamp — From Sectigo's or other trusted timestamp authority
Public Key — Included for independent verification
Authorization Chain — Who called the API, when, with what key

ViriSIM Cryptographic Audit Evidence — SHA-256 hash, ECDSA signature, RFC 3161 timestamp

Comparison

How ViriSIM compares

Most AI governance tools log what happened. ViriSIM proves it.

Capability	Manual Audit Logs	Other Compliance Tools	ViriSIM
Content Integrity	Logs can be edited	Basic logging	SHA-256 hashed
Cryptographic Signature	None	None	ECDSA P-256 signed
Trusted Timestamp	Server clock only	Server timestamp	RFC 3161 (Sectigo)
Hash-Chained Sessions	None	None	Per-session chain
Independently Verifiable	No	No	Yes — public key provided
Customer-Held Keys	N/A	N/A	Supported
Deletion Detection	Silent deletion	Silent deletion	Chain gap visible
DPO Documentation	Manual	Partial	Built into every audit

Who It's For

Built for everyone who needs proof

Compliance Officers

Answer auditor questions with cryptographically sealed evidence — not screenshots or server logs.

CTOs & Engineering Teams

Deploy in minutes. One API endpoint. Works with LangChain, CrewAI, OpenAI, and custom agents.

Auditors & Regulators

Verify evidence independently using the public key. No access to ViriSIM or your systems needed.

Legal Counsel

RFC 3161 timestamps from a trusted authority carry evidentiary weight in legal proceedings.