Audit Ledger · tamper-evident AI audit trails · contact us for pricing
The audit trail a regulator will ask for, managed for you or run by your own team.
When a regulator asks for the audit trail of every decision your AI made, the answer has to be "yes, here it is, and we can prove nothing was changed or deleted." Audit Ledger is the infrastructure that produces that answer. Take it three ways, fixed price agreed before any work starts, or self-host the open source for free.
- EU AI Act Article 12
- FCA SS1/23
- 7-year retention default
- Official MCP Registry
One fixed price, quoted upfront. You choose how it's delivered.
The same production-grade infrastructure either way, always inside your own environment. The only difference is who operates it. The managed option adds a management fee plus usage-based running costs on your own cloud bill, modest and predictable, since the ledger is storage and serverless requests, not LLM inference; the other two are yours to operate from day one. Contact us for pricing on a single deployment; multi-system or multi-region fleets and repeated audit cycles are quoted above tier.
Contact Us
Fixed price · quoted before any work starts
We run and maintain the ledger so your team doesn't have to. You get the evidence and the dashboard; we carry the operations.
- One-off setup and configuration, fixed price
- Ongoing management fee (monthly)
- Cloud running costs billed by usage (mostly storage + requests, no AI inference cost)
- Updates, monitoring, and evidence-retrieval support
- Remote HTTPS MCP endpoint inside your own infrastructure included
- No personal data ever reaches the ledger, only hashed fingerprints and the decision
- Operated inside your own infrastructure (cloud or on-premises) by default
Contact Us
Fixed price · quoted before any work starts
We deploy it into your own infrastructure, cloud or on-premises, and hand it over. Your team owns and operates it from go-live; Zyvra has zero ongoing access.
- Infrastructure-as-code deployment into your own environment (CDK on AWS, or the equivalent)
- Tenant keys, encryption material, and data all inside your boundary
- Remote HTTPS MCP endpoint deployed inside your boundary (basic)
- Wired into your existing monitoring (CloudWatch, Datadog, Splunk)
- Full handover of code, IaC, and runbooks
- 60 days of post-launch support
Contact Us
Fixed price · quoted before any work starts
We package and hand over the code for your team to deploy on your own systems, with setup guidance and a walkthrough.
- The full codebase, CDK stack, SDKs, and dashboard
- Setup configured for your environment and compliance posture
- Deployment walkthrough and runbook handover
- Yours to run, modify, and extend
- 60 days of post-launch support
The repositories are open source under Apache 2.0, free to self-host if your team wants to run it themselves. The paid options exist for when you want it deployed properly, compliance-ready, and supported, rather than built from scratch. See the engineering detail →
Immutable by design. Hashed by default. Tenant-isolated from the first request.
Four design choices are what make the evidence defensible in a regulatory review, and none of them can be bolted on to a system that wasn't built with them in mind:
- S3 Object Lock in COMPLIANCE mode. Records cannot be deleted before their retention date, not by an admin, not by AWS, not by the bucket owner.
- Client-side keyed hashing. Personal data is HMAC-SHA256 hashed in the local process before anything leaves it; the ledger only ever stores irreversible fingerprints, so there is no PII at rest in the audit infrastructure.
- Per-tenant sequence completeness. Every stored decision gets a monotonic sequence number, and a verify-completeness endpoint surfaces any gaps, so you can prove nothing has been deleted, not just that what remains is unaltered.
- Two-key namespace separation. Write keys cannot read; read keys cannot write. A leaked write key cannot exfiltrate data; a leaked read key cannot plant fake records.
The MCP server is published to npm and listed in Anthropic's official MCP Registry. Try every tool zero-config:
The ledger proves what happened. The Evidence Hub proves the decision is ready to face an audit.
A tamper-evident record proves a decision was made and that nothing was changed. An auditor then asks the next question: does that decision have the evidence behind it? The approved model, the data lineage, the policy check, the human sign-off. What is missing, and who owns fixing it?
evidence-hub is the layer that answers it. It sits above the ledger and reads each recorded decision, read-only, so it never alters a recorded record. For every decision it produces an audit-readiness score from 0 to 100 against the evidence an auditor expects, a clear list of what is present versus missing, the owner of each gap, and an exportable audit pack you can hand to a regulator.
So the family is four open-source repositories that work together: audit-ledger (what happened), audit-ledger-mcp (how your AI agents write to it), langgraph-loan-triage (a worked reference agent), and evidence-hub (whether each decision is audit-ready). All Apache 2.0, all deployed inside your own infrastructure, cloud or on-premises.
Even when we manage it for you, your personal data never reaches the ledger.
The hashing happens before anything leaves you. Personal data is HMAC-SHA256 hashed inside your own process, keyed to a secret only you hold, before any record is sent. So the ledger only ever stores irreversible fingerprints (which no one, including Zyvra, can reverse without your key) plus the structured decision and its metadata. Your raw data, and the key that could match the fingerprints, never leave your environment. That's true in every delivery mode, hosting included.
We set up your tenant HMAC key as a standard part of onboarding, so keyed hashing is always on and the guarantee always holds, never the weaker plain-hash fallback.
This is why managing it for you doesn't compromise the usual Zyvra trust model: there is no personal data at rest in the ledger. The ledger always runs inside your own infrastructure (cloud or on-premises); Zyvra never hosts it on our own systems. When you choose the managed option, we operate that instance for you inside your environment, and even then, no personal data reaches it.
On compliance, the trust model is simple: the system runs inside your own environment, so the certifications your infrastructure already carries (your cloud provider's SOC 2 / ISO 27001, or your own data centre's controls) are the ones that apply, and your organisation owns the attestation. Where we provide ongoing managed-service access, some procurement teams will ask about Zyvra as an operator; we'll be straight about exactly what that access covers on the call.
This is not legal advice. Whether the evidence the ledger produces satisfies a specific obligation is a question for your legal counsel. Zyvra builds and runs the technical surface; the deploying organisation owns the attestation.
The ledger and the MCP server, both deployed in your own infrastructure, cloud or on-premises.
For most regulated buyers the real procurement question isn't data sensitivity (the ledger holds no PII), it's the control boundary: can the whole thing run inside our environment, under our keys, networking, logging, retention, and policies? Yes. We deploy both the ledger and the MCP server into your own infrastructure, your cloud account or your own data centre. Your AI agents connect to a remote HTTPS MCP endpoint inside your boundary, no local tooling to install, and your keys, logs, records, retention policy, and network controls all stay with you. Zyvra operates it under a managed agreement, or hands it over for your team to run.
A sensible cloud shape on AWS, fitted to your stack (the equivalents map to other clouds or to on-premises):
- MCP server on ECS Fargate, Lambda + API Gateway, or App Runner, exposed as a remote HTTPS MCP endpoint, not just
npx audit-ledger-mcp. - Auth via OAuth/OIDC, API keys, or an IAM-backed gateway, depending on your stack.
- Secrets in AWS Secrets Manager / KMS; ledger storage stays in your account.
- Optional private access via PrivateLink, VPN, IP allowlist, or an internal ALB.
- Logs and metrics to your CloudWatch, Datadog, or Splunk.
A basic remote MCP deployment is included with the deployed and managed options. Advanced enterprise requirements, SSO/OIDC, private networking, tenant routing, deep observability, and support SLAs, are priced separately.
One honest nuance: if the hashing runs in the cloud MCP server rather than client-side, raw input reaches that server. That's still sound when the server sits inside your own cloud boundary. The guarantee is "hash before it leaves the client-controlled environment," and your cloud is that environment. The strongest posture is still to hash before data leaves you; we'll design to whichever line your compliance team draws.
Tell us which way you want it.
Send a brief note on your use case, your regulator, and whether you'd like it managed by us inside your environment, deployed into your own infrastructure (cloud or on-premises) for your team to run, or handed over as code. We'll reply within two business days, with an NDA in place first if you'd like one.