For compliance teams
Evidence for auditors, built as you work
Eleven controls worked out from real activity, mapped to the frameworks your auditors ask about.
Review practice against frameworks
Computed from your data| Row | EU AI Act | NIST AI RMF | UK GDPR |
|---|---|---|---|
| Human oversight | |||
| Record keeping | |||
| Incident response | |||
| Change control |
Fix first
- Add a rule for 6 unchecked actionsHigh
- Name an owner for each agentMedium
Pack
- Signed
- Yes
- Printable
- PDF and JSON
- Certified
- No. It maps, it does not certify
Decision log
Last hourResult: anySearch actions| Time | Agent | Action | Amount | Answered by | Wait | Result |
|---|---|---|---|---|---|---|
| 14:09:41 | refund-agent | refund.issue | £540.00 | PS | 6m 12s | Approved |
| 14:08:12 | support-agent | email.send | – | M | 1m 04s | Approved |
| 14:06:55 | billing-agent | db.update | – | Rule | 12 ms | Passed |
| 14:05:30 | payout-agent | payout.create | £12,000.00 | Rule | 9 ms | Refused |
| 14:03:02 | support-agent | ticket.close | – | Rule | 7 ms | Passed |
| 14:01:17 | refund-agent | refund.issue | £310.00 | P | 2m 41s | Approved |
| 13:58:44 | refund-agent | refund.issue | £880.00 | PS | 9m 30s | Approved |
| 13:55:09 | sales-agent | discount.apply | 15% | M | 4m 18s | Approved |
| 13:52:31 | billing-agent | invoice.void | £1,240.00 | P | waiting | Waiting |
Decisions per hour
Answered by peopleLet through by ruleChain
Intact- #4819
a41f…09d213:41 - #4820
c7e0…51ab13:52 - #4821
09bd…e3f714:01 - #4822
5be2…7c4414:09
Each record holds the fingerprint of the one before it.
Check it yourself
Offline$ xevrion verify rec_4822 --key public.pem
✓ signature matches key 7f2c
✓ record is in the log (position 4,822)
✓ 4,821 links before it add up
verified in 38 ms, no network usedSigning keys
Public7f2cActive since 1 AugSigning3a91Retired 31 JulVerify only
Old records stay checkable after a key changes.
This hour
Your jobs
What compliance gets done
Show the controls
Four-eyes on high risk, independence, timeliness and more.
Hand over proof
A signed pack and a printable report.
Keep and remove data
Retention, legal hold and erasure that keep proofs valid.
Getting started
Your first week
- Day 1: switch on the recordEvery decision is signed and chained from the start.
- Day 2: set retentionChoose how long data is kept, and add a legal hold if needed.
- Day 4: read the controlsSee which controls your real activity already meets.
- Day 5: export the packHand an auditor a signed pack they can check offline.
Improve
Compliance evidence packs
See how your review practice lines up with common frameworks, with a ranked list of what to fix first.
- Computed, not typedFour-eyes on high risk, independence, timeliness, SSO, log export, signing and more, from real activity.
- Mapped to frameworksEU AI Act, NIST AI RMF, ISO/IEC 42001, SOC 2 and GDPR.
- Signed and printableA signed JSON pack and a report you can print.
Your practice, by framework
Computed| Row | EU AI Act | NIST AI RMF | UK GDPR |
|---|---|---|---|
| Human oversight | |||
| Record keeping | |||
| Incident response | |||
| Change control |
Fix first
Ranked- 6 actions had no checkHigh
- 2 agents have no ownerMedium
- Policy tests not run on releaseLow
Prove
Public proof
Share a link that lets anyone check a single decision against our published keys, offline.
- Nothing else revealedThe check covers one decision. The rest of your log stays private.
- Offline checkIn a browser, or with a few lines of code. No call to us needed.
- Revocable linksSwitch a share link off whenever you like.
Shared decision
No sign-in needed- Action
- refund.issue · £540
- Decision
- Approved by 2 of 2
- Decided
- 26 Oct 2026, 10:44 UTC
- Policy
- refunds v12
- Hidden
- Customer name, order contents
Checked in your browser
Offline- Receipt signature matchesed25519
- Included in the logleaf 48,211
- Checkpoint signed#9,402
- Link not revoked
Prove
Signed receipts
Each decision comes with a signed receipt and an evidence pack: who, what, when, and why.
- SignedA receipt cannot be changed without breaking its signature.
- Evidence pack per requestThe data, the rule, the reviewer and the result in one bundle.
- Hashes over the plain textHashes are taken over readable data, so proofs still verify when stored data is encrypted.
Signed receipt
Refund £540- Who
- Priya N., Sam O.
- What
- refund.issue · order 88231
- When
- 10:43 and 10:44 UTC
- Why
- Over £500, two reviewers
- Signature
- Valid
Evidence pack
- Receiptreceipt.json2 KB
- Policy at the timerefunds v121 KB
- Reviewer answers2 signed3 KB
- Log inclusion proofleaf 48,2111 KB
Hashes over plain text
action_hash 9c1e…a402policy_hash 41bd…77e0receipt_hash e3f8…10cdControl
Legal hold and retention
Set how long data is kept, pause deletion for a legal hold, and erase on request without breaking proofs.
- Retention rulesChoose how long request data is kept before it is redacted.
- Legal holdFreeze deletion for a case until the hold is lifted.
- Proofs surviveA redaction is itself logged, and the signed record stays checkable.
Retention
By kind of data- Request payloadsDelete after90 days
- Reviewer commentsDelete after1 year
- Signed receipts and proofsKeepKept
- Case 2026-044 legal holdDeletion pausedHold
Erase on request
- Request received
- Personal fields removed
- Hashes and signatures kept
- Proofs still verify
Legal hold
- Scope
- Refund requests, Oct 2026
- Placed by
- Mia K.
- Deletion
- Paused
Observe
Review coverage
Match every action in your traces to a review. See which ones a person approved, which a rule passed, and which had no check at all.
- Five clear statesApproved, auto-approved, rejected but ran anyway, ran before the answer, and unreviewed.
- Gaps become rulesPick an unguarded action and turn it into a rule in a click.
- Only Xevrion can show itOther tools see the run. We hold the review too, so we can join the two.
Unchecked, most common
- customer.email_send62 actionsAdd rule
- order.cancel31 actionsAdd rule
- file.export17 actionsAdd rule
Gap to rule
- Found in a trace
- Rule drafted
- What-if replay
Improve
Insurer pack
Plain signals an insurer asks about, with the figures behind each one, signed and sealed to the recipient you choose.
- What they askHuman review of high-risk work, reviewer independence, limits, two-person control, verified trails.
- Numbers behind eachEvery signal shows its evidence.
- Sealed to one readerOptionally lock it to the recipient's own key.
What they ask
With the figures- Human review of high-risk actions100% of 1,204Yes
- Spend limits per agent6 of 6 agentsYes
- Tamper-evident recordsSigned log, 48,211Yes
- Tested before releaseLast run 26 OctYes
Sealed to
- Reader
- An insurer you choose
- Opens with
- Their key only
- Signed
- Valid
- Expires
- In 30 days
Questions
What compliance teams ask first
Which frameworks does it map to?
Controls are worked out from real activity and mapped to the EU AI Act, the NIST AI RMF and UK GDPR. We map them. We do not certify.
What is in the evidence pack?
A signed pack and a printable report built from the record, which an auditor can check without trusting us.
Can we delete data and keep the proofs valid?
Yes. Retention, legal hold and erasure are built so removing content does not break the chain.
Is this a compliance certificate?
No. It helps you collect evidence. It is not legal advice or certification.
Know what your agents did.
Start free. Guard your first agent in a few minutes, and keep a record anyone can check.
- Free plan, no card
- Signed, chained decisions
- Checked offline, without us
Signed decision
- Decision
- Approved, 2 of 2
- Action
- refund.issue, £540
- Rule
- Two reviewers must agree
- Sealed
- 14:09, key 7f2c
- Hash
- 5be2…7c44
Checked on your own machine
- Signature matches the public key
- Decision is in the log
- Every link before it adds up