Frequently asked questions

Etch is a signed audit chain for AI agent decisions, offline-verifiable against pinned public keys. Every event is signed with a hybrid Ed25519 + FIPS 205 SLH-DSA-SHA2-128f envelope, Merkle-chained into an epoch, and epoch-anchored on Sigstore Rekor + Bitcoin OpenTimestamps.

Attach an MCP-compliant client (Claude Code, Cursor, Continue, Cline, Codex) to a signed-chain server such as Etch. Every tool call your agent makes becomes a signed event on the chain. At review time, walk the chain to see the exact context, policy version, and sign-off for any past decision. The reference verifier runs offline so no runtime dependency on the audit provider.

A per-project append-only log where every event is cryptographically signed and epoch-anchored so no one, including the operator, can rewrite history without cryptographic detection. Etch signs with a hybrid envelope (Ed25519 for classical, FIPS 205 SLH-DSA-SHA2-128f for post-quantum) and anchors epochs on Sigstore Rekor + Bitcoin OpenTimestamps.

A hash-only log gives you tamper-evidence but no authorship, no time anchor beyond the operator's own clock, and no offline verifier for auditors. Etch adds hybrid signing, external epoch anchoring on Sigstore Rekor and Bitcoin OpenTimestamps, and an OSS verifier an auditor pins keys into and runs on their own laptop. None of that depends on Etch staying online.

Sigstore Rekor is a transparency log for software artifacts. Etch is a per-project decision chain for AI agents that ANCHORS its epoch commitments onto Rekor. They compose: Rekor gives Etch a public, auditor-verifiable time anchor for every epoch; Etch gives Rekor a domain-specific semantic layer (agent events, framework mapping, discharge access, silent control failures) that Rekor does not model. See https://etch.systems/vs/sigstore-rekor for the full comparison.

C2PA is a content-provenance manifest attached to media files (images, video, documents). Etch is a decision chain that records what an AI agent did with inputs, at what time, on whose behalf. Different artifacts, different questions: C2PA answers 'was this image edited by AI'; Etch answers 'who reviewed this AI output and applied what policy'. They compose: an Etch event can reference a C2PA manifest as an attached entity. See https://etch.systems/vs/c2pa.

Yes. Every signed event carries both a classical Ed25519 signature (FIPS 186-5) and a post-quantum SLH-DSA-SHA2-128f signature (FIPS 205). A verifier requires BOTH signatures to validate. If either scheme is broken in the future, the other still protects the record.

Etch ships a framework-mapping surface (AARM: audit-and-attestation reference model) that maps each Etch primitive to the specific section of each framework the primitive discharges evidence for. SR 11-7 model-risk-management, EU AI Act Article 12 record-keeping, ISO 42001 clauses A.6-A.9, NIST AI RMF Measure and Manage functions. See https://etch.systems/aarm for the full mapping.

The auditor pins the project's public-key fingerprints once (at pilot onboarding) and runs the OSS reference verifier on their own laptop. The verifier walks the signed chain, recomputes every event hash, verifies the hybrid signatures, checks the Sigstore Rekor and Bitcoin OpenTimestamps anchors, and reports any detected tampering. Etch never sees the verifier's traffic; it is offline against pinned keys.

Run one curl command: curl -X POST https://etch.systems/v1/your-project. The response returns a bearer token, an anonymous project id, and an MCP endpoint URL. Point any MCP-compliant client at the endpoint with the bearer and start writing signed events. Anonymous projects carry 500 events over 14 days; convert to a persistent project any time to keep the chain forever.