Skip to main content
Security

You Can't Secure What You Can't Audit

Runtime security tells you an agent can do something. Forensic evidence tells you what it actually did — and proves it cryptographically. AI Identity is the evidence layer for AI security: tamper-evident audit chains, signed attestations, offline verification.

Where AI Identity fits in your security stack

Runtime security

Prevention layer

CASB, DLP, prompt injection guards, jailbreak detection. Stops bad actions before they happen.

AI Identity

Evidence layer

Cryptographic audit chain + signed attestations. Proves what every agent did, offline-verifiable.

SIEM / SOC

Response layer

Splunk, Datadog, Chronicle. Correlates events, alerts on incidents, drives investigation workflows.

We don't replace your runtime controls or your SIEM. We give them an unforgeable source of truth to act on.

Tamper-Evident Audit Chain

Every agent action is cryptographically chained using HMAC-SHA256. Each entry includes the hash of the previous entry, creating an unbroken chain. Alter one record and the chain breaks — making tampering detectable and provable.

Signed Session Attestations

Each session is sealed with a DSSE envelope signed by ECDSA P-256 keys held in cloud KMS — the private key never leaves the HSM. Auditors fetch the public JWKS and verify offline. No vendor trust required.

Zero-Trust Architecture

Every request is authenticated and authorized before processing. No implicit trust, no shortcuts. The gateway validates agent identity, checks policy, and writes the audit record before any request reaches an LLM provider.

Fail-Closed by Default

If something goes wrong during policy evaluation — timeout, error, ambiguity — the request is denied. Agents cannot bypass controls, even during partial outages. Security is the default, not the exception.

Encrypted Credential Vault

LLM provider API keys are stored encrypted at rest (AES-256) and only decrypted in-memory at request time. Agents never see or handle raw provider credentials.

Tenant Isolation

PostgreSQL Row-Level Security (FORCE) ensures complete data isolation between organizations. One customer's agents, policies, keys, and audit logs can never leak into another's — even with an application-level vulnerability.

Compliance Alignment

Built to satisfy the frameworks your security and compliance teams care about most.

SOC 2 Type II

Architecture aligned

Logical access controls, tamper-evident audit trail, encryption, tenant isolation.

NIST AI RMF

Framework supported

Agent observability, policy governance, cryptographic integrity, fail-closed design.

EU AI Act

High-risk ready

Human oversight, traceability, transparent enforcement, audit log export.

See the evidence layer in action

Walk through a live incident replay, read the architecture, or talk to us about the design partner cohort.