VaultTrace

A notary, not a logger

• Not a logger

  Logs are plain text on infrastructure that can be edited, deleted or subpoenaed. A log tells you what someone says happened. A certificate proves what did happen.

• Not a monitor

  Monitoring observes in real time and leaves nothing permanent. When the window closes the evidence is gone. A certificate survives the session, the system and the vendor.

• Not a dashboard

  Dashboards aggregate and visualise. VaultTrace does not replace your observability stack — it sits beside it and makes every recorded event independently auditable.

• A cryptographic notary

  It binds model identity, execution environment, input and output hashes and policy evaluation into one signed certificate, anchored in an append-only ledger.

One decorator

The decorator captures the model call, hashes inputs and outputs, evaluates the policy, signs the certificate and stores it — without changing the logic or the return value of the function.

from vaulttrace import audit

@audit(policy="contract_review_v2", retention_days=2555)
def review_contract(document: str) -> dict:
    response = client.chat.completions.create(
        model="gpt-4o",
        messages=[{"role": "user", "content": document}],
    )
    return response.choices[0].message

The certification pipeline runs asynchronously, so it does not sit on your critical path.

Provider-agnostic

• ClaudeAnthropic API
• GPT / o-seriesOpenAI API
• GrokxAI API
• GeminiGoogle AI
• OllamaLocal models, weight hash captured

Where a failed audit is a matter of when, not if

• Legal services

  Firms using AI to review contracts or draft clauses must show human oversight on every case. VaultTrace creates an auditable chain of custody for each AI-assisted output.

• Financial services

  Credit decisions, investment recommendations and fraud detection have to be justified to a regulator years later, under frameworks such as SR 11-7, EBA guidelines or MiFID II.

• Healthcare

  Proof that plaintext was never stored. Only hashes are retained: sufficient for audit, insufficient for reconstruction.

• High-risk AI under the EU AI Act

  Annex III systems face mandatory logging, human oversight and technical documentation. The five proofs map directly onto those obligations.