For Compliance Officers
End-to-end governance for AI work — auditable, signed, regulator-ready.
Every Skill chain, every agent run, every tool call lands in one cryptographically chained audit log aligned with NIST AI RMF, ISO/IEC 42001, EU AI Act, GDPR Article 22, and SOC 2 evidence expectations. Export as a cryptographically signed Evidence Pack your auditor can verify offline — without our server.
This is the Run plane — governing how your business operates with AI. Need to govern how your developers build with AI? See the Build plane →
Control mapping out of the box
Aligned with NIST AI RMF, ISO/IEC 42001, EU AI Act, GDPR Article 22, and SOC 2 evidence expectations — pre-mapped per skill, with per-org overrides. Closed-set hallucination guard cross-checks every cited control ID against a 259+ truth set so fabricated references can't pass. Compliance team owns the policy; engineering team owns the workflow.
NIST · ISO 42001 · EU AI Act · GDPR · SOC 2
Cryptographically signed audit
Every audit row is part of a tenant-scoped chain so cross-tenant tampering is structurally detectable. Evidence Pack export signs the manifest; a regulator can verify the pack offline using a standalone open-source verifier — no Proofpane backend required.
Standalone offline verifier (open-source)
Workflow + agent unified
Skill chains (intake → triage → review) and agent runs go through one policy gate, one audit chain, and one cost gate. Partial governance is no governance — auditors don't accept partial.
End-to-end governance thesis
“Why is this your production default?” — one URL, frozen JSON.
Every production default — which prompt variant ships, which memory strategy lives, which provider is the baseline — passes (a) a statistical significance gate over a content-hashed fixture, then (b) an inter-rater reliability floor (Krippendorff α with bootstrap CI — the same measure clinical-trial reviewers use to prove humans agree above chance). The verdict, the confidence interval, the fixture hash, the DLP rule-set fingerprint, the approving operator — all frozen on the audit row. Your auditor reconstructs why this is the current default from the bundle alone. No meeting required. No engineer dragged in. Six years from now, same answer, same hash.
# /promotions row — frozen at promote time, replayable forever
{
"dimension": "memory_strategy",
"winning_variant": "simple",
"verdict": {
"winner": "simple",
"rank": [1, 2],
"per_variant_retention": [0.91, 0.29]
},
"significance": {
"effect_size": 0.620,
"ci_low": 0.215,
"ci_high": 0.890,
"n": 22
},
"evidence": {
"fixture_hash": "8a3f72…d401",
"dlp_rules_version":"b1c43e…ff02",
"audit_run_id": "exprun_a1b2c3…"
},
"measurability": {
"alpha_HH": 0.86,
"ci": [0.81, 0.91],
"band": "auto-eligible"
}
}Why teams pick us
The product surface isn't load-bearing — the substrate is. These three properties are what hold up under a regulator's third question, not the first.
Multi-tenant by construction
Every record carries its tenant identifier and the audit chain is scoped per tenant, so cross-tenant tampering is structurally detectable — not just policy-detected. The isolation contract is pinned by a comprehensive test suite that runs on every change.
Multi-tenant isolation, pinned by tests
Self-improving policies, approval-gated
When quality drifts, the system proposes a prompt edit, sandboxes it against past failing samples, and asks an admin to approve before going anywhere near production. Every approval carries approver, rationale, and linked diff in the audit chain. Reversible. Never auto-applied.
Approval-gated prompt evolution
Open verifier, no vendor lock-in
The Evidence Pack verifier is a standalone open-source script. Your auditor downloads it once and verifies any pack offline — forever, even if Proofpane disappears. Other vendors' compliance reports need their server to validate. Ours don't.
Standalone offline verifier (open-source)
What the auditor receives
One signed zip per time range. The manifest enumerates every event in the slice, the chain hash at start and end, and the compliance coverage matrix. The verifier is open-source and standalone.
# Verify offline — no Proofpane server required.
$ proofpane-verify q3-2026-evidence.zip
✓ Pack version: evidence-pack/1.4
✓ Manifest signature valid
✓ Audit chain intact: no gaps
✓ Control mapping observed:
NIST AI RMF → all configured controls
ISO 42001 → all configured controls
EU AI Act → all configured obligations
GDPR → Article 22 obligations
SOC 2 → Trust Services Criteria
✓ Tenant isolation: confirmed
✓ Runtime intervention chain: 4 pauses, all resolved
✓ Pack is verified.Are you an engineer, not a compliance officer?
See the developer-facing pitch →