Every decision, signed. Every chain, anchored.
Screenshots don't survive a deposition. ShadowIQ writes cryptographic proof into every AI decision — Ed25519-signed, Merkle-hashed, Sigstore-anchored — so auditors, regulators, and boards get evidence they can verify themselves.
Cryptographic receipts for a category that used to run on PDFs.
Three moves, fully automated.
No long onboarding, no hand-rolled detection rules. ShadowIQ ships with defaults tuned to the regulatory floor — customize only where your risk appetite demands.
Every decision is sealed.
Gateway output → canonical JSON → Ed25519 signature. Seal includes timestamp, policy version, model fingerprint, and content hash.
Seals chain into a ledger.
Sealed decisions roll into hourly Merkle trees. Merkle roots are published to a transparency log (Sigstore Rekor or a private anchor you control).
Auditors verify independently.
Auditor workspace includes a zero-trust verifier — they confirm a proof with your public key alone. They never need ShadowIQ credentials.
Every control a regulator or auditor will ask about.
Ed25519 everywhere
FIPS-validated curves, rotating keys, HSM-backed signing option. Algorithm agility for post-quantum migration.
Merkle anchoring
Append-only, hourly rollups, Rekor-style transparency. Any past decision is provable in O(log n).
Sigstore + bring-your-own
Public Sigstore anchor by default. Optionally anchor to an AWS QLDB, GCS object-lock bucket, or a private ETSI-compliant service.
OSCAL one-click
System Security Plans (SSPs), component definitions, and assessment results in OSCAL — auditors consume them directly.
Framework maps
EU AI Act article ↔ control ↔ evidence artifact mapping. The same evidence satisfies multiple frameworks.
Retention & residency
Tiered storage: hot (90 days), warm (1 year), cold (7+ years). Regional pinning by default; residency-as-code for multi-jurisdiction.
Zero-trust workspace
Auditor accounts get a read-only, verifier-only console. They confirm decisions with your public key alone. You keep the signing keys.
Evidence API
Query any decision by timestamp, policy, user, tenant, or model. Sign a subset, export, revoke — all API-driven.
Forensic timelines
Reconstruct the exact sequence of AI decisions around an incident, signed and timestamped, in minutes — not weeks.
Answered by the architecture, not the sales deck.
Every seal is signed by keys you control (or that are HSM-backed in your cloud account). Roots anchor to an external transparency log — we can't rewrite history without detection, and neither can you.
It's the useful part — cryptographic transparency logs — without the price tag or latency. No tokens, no consensus protocol, no public chain. Think Certificate Transparency, not Ethereum.
Yes. We've piloted with Big-4 and boutique auditors. OSCAL export, verifier-only workspace, and hash-chain integrity all get strong reactions. It's the first evidence model most of them have seen that they can independently verify.
We have algorithm agility built in. Today Ed25519; when NIST PQC profiles firm up, we can re-sign archive roots and rotate to hybrid signatures without rewriting customer data.