ForgeSynapse
VaultTrace
Signed, tamper-evident records of AI sessions
A record-keeping tool for AI compute. It records the model the provider declared, the environment and hashes of inputs and outputs, and signs each record on your infrastructure.
- v0.2.0.dev1 · pre-release
- Apache-2.0 core
- ECDSA P-384
The problem
You may be asked what your AI did
Any AI system can claim it ran model X, on data Y, at time Z. Plain-text logs can be edited or deleted, and they usually sit on infrastructure controlled by the same team that is being asked to show them.
That is not only a compliance question, although the EU AI Act, the NIST AI RMF and sector frameworks make it more pressing. It is a question of who holds the record: no AI provider can audit its own model without a conflict of interest, and legal responsibility often falls on the organisation deploying the system, not on the model vendor.
When an AI decision approves a loan, flags a transaction, drafts a clause or triages a patient, the organisation may have to show, years later, what happened. A signed record kept at the time is a better starting point than a reconstruction.
What it is
A signed record, not a plain log
Not a plain log
A plain-text log can be edited or deleted without a trace. A VaultTrace record is signed and chained to the previous one, so changes made outside the API are detectable.
Not a monitor
Monitoring watches in real time and keeps nothing permanent. A VaultTrace record is written to a local append-only ledger and outlives the session.
Not a dashboard
VaultTrace does not replace your observability stack. It sits beside it and keeps a signed record of each audited call.
A signed record
It binds the declared model identity, the execution environment, input and output hashes and policy evaluation into one signed certificate, stored in a local append-only ledger.
The certificate
Five proofs per session
- 01
Identity
Which model the record says ran. For local models, when you provide the weights path, the SHA-256 of the weights. For cloud models, the model ID declared by the provider’s API, with a timestamp. That is the provider’s declaration; VaultTrace does not verify it independently.
- 02
Environment
Hardware, operating system and dependency tree at the moment of execution, with an NTP-checked timestamp.
- 03
Confidentiality
Inputs and outputs are stored only as SHA-256 hashes, never as plaintext. Enough to show what was processed, never enough to reconstruct it.
- 04
Correctness
The SHA-256 of the output as generated is recorded and signed. A later change to the stored record breaks its signature and the hash chain.
- 05
Governance
Which policies were evaluated (model whitelist, token budget, data retention, timestamp offset, human oversight for high-risk categories) and whether each passed, failed or raised a warning. It records the check; it does not make the system compliant.
How it works
From API call to signed record
- 01
Call intercepted
Request and response are captured in flight, without touching the return value of your function.
- 02
Five proofs assembled
Identity, environment, confidentiality, correctness and governance are evaluated around your call.
- 03
Certificate signed
The certificate is signed with ECDSA P-384. Its structure is modelled on the W3C Verifiable Credentials data model; conformance is not claimed.
- 04
Chained into the ledger
Each certificate is hash-chained to the previous one in an append-only local ledger. Database triggers block updates and deletes, and a change made outside the API breaks the chain.
Integration
One decorator
The decorator captures the model call, hashes inputs and outputs, evaluates the configured policies, signs the record and stores it in your local ledger, without changing the return value of the function.
import vaulttrace
vaulttrace.init(organization_id="org_your_company")
@vaulttrace.audit
def review_contract(document: str):
return client.chat.completions.create(
model="gpt-4o",
messages=[{"role": "user", "content": document}],
)If VaultTrace itself fails, your AI call still completes: fail_open is on by default.
Provider-agnostic
- ClaudeAnthropic API
- GPT / o-seriesOpenAI API
- GrokxAI API
- GeminiGoogle AI
- OllamaLocal models, weights hash when the weights path is provided
Available now
Community, Professional and Enterprise
What you can use in the current release (0.2.0.dev1, pre-release). Session limits and tier levels are read from the licence policy (policy version 2026.09.1). Not in the current release: the dashboard (planned for every tier), Spendlock, hardware (TEE) attestation, ledger anchoring and multi-tenant support.
| — | Community | Professional | Enterprise |
|---|---|---|---|
| Price | Free | On request | On request |
| AI sessions per month | 250 | No monthly limit | No monthly limit |
| Licence key | None | ECDSA-signed key | ECDSA-signed key |
| How you get it | Self-host from source. No card required. | Written order. Key issued manually. No online checkout. | Written order. Key issued manually. No online checkout. |
| Support SLA | None | 48h | 4h |
| What it includes | Signed session records, append-only local ledger, five LLM adapters, CLI (verify, audit, status) | Everything in Community, without the monthly limit | Everything in Professional |
| Ideal for | Developers and small teams trying signed session records | Teams that need more than the Community session limit | Organisations that need a higher support level and contract terms |
Listed pricing — not in the current release
Listed / next
These prices and features are listed for planning. They are not part of the current release and cannot be ordered today.
| — | Professional | Enterprise |
|---|---|---|
| Listed price | 199 USD / month · 1,990 USD / year (159 GBP / 183 EUR per month)¹ | From 36,000 USD / year (28,800 GBP / 33,120 EUR per year)¹ |
| Usage unit | Decision, a future unit. It is not charged in the current release. | Decision, a future unit. It is not charged in the current release. |
| Listed features |
|
|
¹ GBP and EUR converted at 1 USD = 0.80 GBP = 0.92 EUR.
Who it is for
Teams that may be asked what their AI did
Legal services
Firms using AI to review contracts or draft clauses can keep a signed record of each AI-assisted call, including the human-oversight flag they declare.
Financial services
Teams that must explain automated decisions later can keep signed records of the model, environment and policy checks behind each call. VaultTrace does not assess compliance with any framework.
Healthcare
Only SHA-256 hashes of inputs and outputs are kept, never plaintext: enough to show that a record was not changed later, not enough to reconstruct the content.
High-risk AI under the EU AI Act
Records like these can support the logging and documentation work that high-risk systems require. Under Regulation (EU) 2026/1744, the Annex III high-risk obligations apply from 2 December 2027. VaultTrace does not certify conformity.
Limitations
What VaultTrace does not do
A tool that keeps records has to be honest about their boundaries. These are ours.
- It does not make your AI correct. It records what ran, on what, and under which policies. Deciding whether that was the right thing to run remains yours.
- It is not a compliance certification and not legal advice. The export produces an evidence pack from your ledger and the organisation profile you supply. Its sections follow the Annex IV numbering, but it is not the technical documentation the EU AI Act requires the provider to draw up.
- On cloud models, identity is the model ID declared by the provider’s own API, recorded as returned. VaultTrace does not verify it independently, and hardware (TEE) attestation is not offered.
- Records are signed with a key held on the machine that runs VaultTrace. Anyone who controls both that key and the ledger can rewrite history; the hash chain exposes changes made outside the API. There is no external anchoring today.
- The signature scheme is specific to VaultTrace: ECDSA P-384 over a double SHA-256 digest of canonical JSON. A public, standards-based verification specification has not been published yet.
- The Community tier is limited to 250 AI sessions per month, checked by the SDK before each audited call. We would rather you read that here than discover it in production.
- The export command works in every tier today. The tier policy lists export for Professional and Enterprise, and the CLI does not enforce that yet.
- The SDK is Python-first. Other runtimes integrate through the CLI and the export format, not through a native decorator.
Start with the Community tier
The core is open source. Install it from source, generate your first signed record and check the ledger yourself before deciding whether it belongs in production. This is a pre-release (0.2.0.dev1); the 0.1.0 package on PyPI is superseded and not recommended.