Security & Compliance

Built for audit.
Designed for trust.

Every component of Evidentia is designed around tamper-evidence, verifiability, and audit readiness. This page documents the technical and operational foundations of that commitment.

SHA-256 Hash Chain Ed25519 Signatures RFC 3161 Timestamping WORM-equivalent Storage Third-party Verification Chain of Custody
Core Technical Controls

Six layers of tamper-evidence.

Each layer independently protects the integrity of evidence records. Together they create a chain that is cryptographically impossible to alter silently.

🔗

Tamper-evident Records — Hash Chain

Every AI interaction event is hashed using SHA-256. Each record includes the hash of the previous record, forming a sequential chain. Any modification to any record invalidates all subsequent records — making silent tampering cryptographically impossible to conceal.

SHA-256Merkle TreeSequential Chain
✍️

Cryptographic Signatures — Ed25519

Each evidence record is signed using Ed25519 — an elliptic curve scheme providing strong authenticity with compact key sizes. Signatures prove the record originated from Evidentia and has not been altered post-creation. Verifiable by any third party with the public key.

Ed25519Asymmetric SigningOrigin Verification
⏱

Trusted Timestamping — RFC 3161-compatible

Evidence records are anchored using a trusted timestamping architecture compatible with RFC 3161, with NTP synchronization for additional time verification. This establishes a reliable record of when evidence was created — independently of Evidentia's own infrastructure.

RFC 3161-compatibleTSA / NotaryNTP Sync
🗄️

WORM-equivalent Storage

Evidence records are stored in append-only, write-once storage with AES-GCM encryption at rest. Records cannot be modified or deleted after creation. Key management follows a two-tier KMS architecture with separation of duties.

Append-onlyAES-GCMTwo-tier KMS
📦

Chain of Custody

Evidentia tracks the full lifecycle of each evidence record — from capture through storage, anchoring, and verification. Every access, export, and key operation is itself logged as a tamper-evident record. The audit infrastructure audits itself.

Access LoggingSelf-auditableExport Tracking
🔍

Third-party Verification

Evidence records are anchored to independent public ledgers. Any auditor, regulator, or legal counsel can verify the integrity of a record without accessing your raw data or relying on Evidentia's infrastructure. Verification is cryptographically self-contained.

Independent AnchoringPublic VerificationNo Raw Data Required
Data Architecture

What we process.
What stays with you.

Evidentia is built on a privacy-first principle. We process only cryptographic proof data. Your raw AI content never enters our systems — by architectural design, not just policy.

Evidence Record — Example Structure
{
  "evidence_id": "EV-20260328-0091",
  "event_hash": "sha256:a3f8c2d1e4b7f9c3...",
  "signature": "ed25519:7b9e1d4f2c8a...",
  "timestamp": "2026-03-28T09:14:22Z",
  "tsa_token": "rfc3161:4f2a8c1b...",
  "anchor_ref": "ledger:0xb3d9f2e1...",
  "model_version": "gpt-4-turbo-2024",
  // raw_input: NOT STORED — remains in your environment
  // raw_output: NOT STORED — remains in your environment
}

✓ Processed by Evidentia

  • SHA-256 hash of the interaction
  • Ed25519 digital signature
  • Trusted timestamp record
  • Model version and metadata
  • Anchor reference (ledger proof)
  • Verification records

✕ Never enters our systems

  • Raw AI prompts or inputs
  • AI-generated outputs
  • Sensitive business content
  • Personal or identifiable data
  • Confidential documents
Compliance Posture

Regulatory alignment.

Evidentia is designed to support compliance workflows in regulated environments. The following reflects our current design posture and roadmap.

EU AI Act

Designed to support audit trail requirements for high-risk AI system documentation under the EU AI Act framework.

GDPR

Privacy-by-design architecture. Raw personal data is never processed. Controller / Processor responsibilities can be documented in customer agreements to support Article 28 workflows.

Cross-border Transfers

Designed to support Standard Contractual Clauses (SCC) for EU data transfers. DPIA-ready documentation can be provided for enterprise deployments.

Important: Evidentia provides audit-readiness and tamper-evident record infrastructure. We do not provide legal advice. The admissibility or evidentiary value of records in specific jurisdictions is determined by applicable law and must be assessed by qualified legal counsel.

Get Started

Ready to discuss your
compliance requirements?

We work directly with compliance, legal, and IT teams to scope the right implementation for your environment.

Request an AI Audit Walkthrough