Use cases · Whitepapers · Guides
Everything we know, without a form in front of it.
No email gate, no “talk to sales to download”. If the work is good it should travel; if it is not, a landing page was never going to save it.
Use cases
Six rooms this walks into. Pick the one you are standing in.
The incident nobody can reconstruct
Someone pasted a customer file into a chatbot last quarter. Nobody can say what it contained, when it went, or which model saw it. What a complete record looks like, and why it cannot be rebuilt after the fact.
Read the write-up Sales enablementThe questionnaire you cannot answer
“Describe the controls governing your use of AI on customer data.” The evidence a buyer's security team accepts, the wording that survives their follow-up question, and the answer that quietly loses the deal.
Read the write-up Agent operationsThe agent that spent money
An agent holding your payment key, running unattended at three in the morning. Why a card number on a payment route is recorded rather than substituted, and why a write waits for a person by default.
Read the write-up Managed servicesThe quarterly client review
How one engineer produces signed evidence for twenty clients without assembling screenshots the night before each meeting.
Read the write-up DiscoveryFinding the AI nobody registered
Discovery is commoditising. The valuable half is a coverage report that names its own blind spots.
Read the write-up DisputeWhen the other side says otherwise
A customer alleges their data was used to train a model. Your logs are your logs, written by you, and you are the disputed party. What kind of record carries weight when the reader has reason to doubt you.
Read the write-upWhitepapers
The research behind it. Ours, and checkable.
Evidence that survives a hostile reader
The receipt architecture end to end: RFC 8785 canonicalisation, RFC 9052 signatures, RFC 9162 log proofs, RFC 3161 timestamps, and for each the alternative we rejected and why.
Read Original research · read onlineWhy 22 of 62 MCP servers cannot be governed
Every vendor MCP server we could reach, measured one by one: 33 can be fronted, 22 refuse on OAuth, 5 gate on client identity. What that means for anyone buying agent tooling this year.
Read Regulation · read onlineWhat the EU AI Act asks of you today
Regulation 2026/1744 is law and the high-risk obligations are deferred. The articles that bite now, the dates that do not, and what Article 12 record-keeping actually describes.
Read Method · read onlineObserved, attested, asserted
A provenance model for AI evidence, and the argument at the centre of this company: a record that cannot tell these three apart is not evidence, however much of it you keep.
ReadComparisons and standards
Where we sit beside what you already run.
Lyntway and Microsoft Purview
Every Microsoft claim quoted from its own documentation, with the link. Where Purview is the right answer, the page says so.
Read StandardAIUC-1, control by control
What a receipt can evidence under AIUC-1 and what it cannot. We are not AIUC-1 certified, and the page says so first.
ReadAnd the practical ones, for the person doing the work.
Verifying a receipt by hand
From the specs alone, with no tooling of ours. If you can follow it, the receipt stands on its own.
GuideSelf-hosting in an afternoon
Helm, Terraform or the container, against an empty Postgres. Starts in about a second.
GuideFinding where your AI traffic goes
A coverage walk you can run this week, whether or not you ever buy anything from us.
GuideMapping evidence to your framework
Which controls a traffic receipt can carry, which it cannot, and how to cite it precisely.