Every AI agent decision, signed into evidence any third party can verify.
Etch records every AI agent decision as a signed event: the prompt, the context, the tools called, the outcome. Every record carries a post-quantum hybrid signature, chains into epochs, and anchors to two independent public infrastructures. Six months later, a reviewer verifies the record on their own laptop against pinned keys, with no vendor cooperation required. Etch is the evidence layer. It proves what happened. It does not decide what should happen. Hand the record to your auditor, customer or insurer. They verify it without trusting you or us.
curl -X POST https://etch.systems/v1/your-project
Returns a bearer token and an MCP endpoint URL. Point
any MCP client at etch.systems/mcp and start
writing to a real signed chain. 500 events, 14 days,
convert to a persistent project any time.
See the walkthrough.
ijson parse, no vendor dependency.
From the public evidence pack
- 39455tool call: Reada0d7ed17
- 39456tool call: Read5092d107
- 39457tool call: Editbe41e9a1
- 39458tool call: Bashe97ab81e
- Epoch
- 39, entries 38913 to 39936
- Merkle root
- aea8e5ef
- Signatures
- 2
Verified offline
etch-verify: 6 of 6 checks passed
Watch an evidence pack get verified.
Signatures prove authorship. Hashes only prove order.
A hash chain detects tampering but does not tell you WHO signed what. An authenticated audit chain does both. Every epoch is Merkle-hashed AND signed under a key the auditor can pin.
| Etch (signed) | Hash-only log | Plain log | |
|---|---|---|---|
| Signature scheme | Hybrid Ed25519 + SLH-DSA-SHA2-128f (FIPS 205) | None (hash only) | None |
| Post-quantum ready | Yes (SLH-DSA is NIST PQC) | No | No |
| Offline reference verifier | Yes (etch-verify, streaming) | Vendor-specific | No |
| Framework mapping (EU AI Act / SOC 2 / ISO) | Article + control IDs cited | Ad hoc | None |
| Signed decision receipts | Yes (per epoch) | No | No |
| Human annotation in-chain | pin_annotation MCP tool | No | No |
| Shareable auditor URL (no login) | Yes (expiring share tokens) | No | No |
If you hold your own logs, your auditor has to trust you.
Most agent logs are kept by the same party whose agent did the work. That is fine for debugging. It is a problem when a customer, an auditor or an insurer needs to rely on the record, because they can only take the operator's word for it.
| Platform activity log | Locked storage bucket (WORM) | Etch | |
|---|---|---|---|
| Who holds it | The AI platform | You | You hold a signed copy; epoch roots are anchored in public logs |
| Can the holder change it | Depends on the platform's retention and admin rights | Not during the lock period | Changes are detectable, not prevented |
| Can an outsider check it without trusting the holder | No | No, they trust your storage settings | Yes, offline, against pinned public keys |
| Anchored outside the holder's control | No | No | Yes: Sigstore Rekor and Bitcoin (OpenTimestamps) |
| One record across agent platforms | No, one platform each | Yes, if everything is routed to it | Yes, any MCP client today |
Etch detects edits, removals and reordering of recorded entries. It cannot prove that an action was recorded in the first place. See /security for the full list of guarantees and non-guarantees.
One authenticated audit chain. Three surfaces so developers, auditors, and reviewers each get the tool that fits their job.
Four admissibility-grade primitives, available today.
Beyond the signed chain, Etch provides the four primitives that appear in regulated buyers' RFPs and in court. Each is a first-class endpoint on the platform.
Chain-of-custody export bundle
Session-scoped, self-authenticating JSON bundle aligned with Federal Rule of Evidence 902 (11 / 13 / 14) and EU eIDAS. Chain- signed via an on-chain marker so any auditor can recompute the bundle hash offline and match it against the ledger.
HSM / TPM / enclave attestation
Enterprise brings its own HSM (tpm2 / yubikey / aws-nitro / gcp-shielded / azure-attestation / sev-snp / intel-tdx). Etch attaches the vendor attestation blob to the signed event without routing trust through Etch.
Cross-chain federation
A supplier's chain event can reference a customer's chain event by (chain_id, epoch, event_hash). Cryptographically walkable across organizational boundaries with no central coordinator. Offline + optional online verifier modes.
Signed postmortem + retroactive downgrade
First-class signed retrospective: about_event_id, finding, corrective action + signer, optional retroactive confidence downgrade. Closes the "how do you improve governance over time" loop that SR 11-7 / EU AI Act / SS3/18 require.
Full endpoint catalog on the docs page. All 16 endpoints
exercisable from the etch-record CLI on
PyPI.
Ready to audit what your agents actually decide?
Start free, no credit card. One project. Sign up in 30 seconds. Provision your keys in one click.
Sign up→