Regulated customers have to show what happened, who did it and that the record was not changed afterwards. Neural Inverse Govern (powered by Keystone) writes its evidence into records you can verify yourself, offline, with the keys published by your own installation.
Govern produces evidence toward the controls of frameworks such as SOC 2, ISO/IEC 27001, ISO/IEC 42001, HIPAA and the EU AI Act. It does not certify your organisation; certification stays with you and your assessor.
The records
| Record | What it holds | Integrity | Page |
|---|---|---|---|
| Audit ledger | Every change and every enforced decision, written in the same transaction as the change | Per-organisation HMAC chains, signed epochs every minute, signed Merkle checkpoints every five minutes, an immutability trigger | The audit ledger |
| Cold and archive tiers | Audit entries older than the hot window | Signed Parquet segments, S3 Object Lock in compliance mode for archive tiers | Retention and tiering |
| Signed exports | A time window of the audit log, or of vendor AI events, as NDJSON or CSV | Ed25519-signed manifest with the file's SHA-256 and the first and last entry hash | Exports |
| Client events | What a person did in the Editor, the Agents app or the CLI, recorded by the app | Ordinary entries of the same ledger | Client events |
| Context evidence chain | Which context fed each AI request, which model call used it, which agent instructions a session started with | HMAC chain keyed with NI_OBSERVABILITY_SIGNING_KEY, verified daily | Retrieval and attribution |
| Vendor AI events | Audit and usage logs of third-party AI tools, pulled or pushed | Deduplicated, read-only to tenants, exportable with a signed manifest | Vendor connectors, Push receivers |
| Compliance records | Rule pack subscriptions, check findings, evidence records, GDPR Article 22 decision records, break-glass overrides | Each creation audited in the same transaction; evidence content hashed | Compliance rule packs |
Verify it yourself
- The public keys that verify checkpoints, epochs, export manifests and cold segments are published at
/.well-known/keystone-audit-keys.jsonon your installation. keystone-audit-verifychecks an exported chain, the cold tier and an organisation's own segments without network access. See Verify offline.GET /api/v1/audit-logs/verifychecks the chain in place; longer ranges run as verification jobs. Each verification is itself audited.
Keys to keep stable
| Key | Protects | If it changes |
|---|---|---|
NI_AUTH_AUDIT_HMAC_KEY | The audit hash chains | Every existing chain fails verification |
KMS_MASTER_KEY | Seals the audit signing keys (Ed25519) | Sealed keys cannot be opened; the server stops |
NI_OBSERVABILITY_SIGNING_KEY | The context evidence chain | Every existing evidence chain is reported broken |
Generate each once per installation, keep it in your secret store and include it in your recovery plan. See Deploy and operate.
Maturity
Only working features are described in this section. These evidence features exist in the product but are not described as working here:
| Feature | Status | Why |
|---|---|---|
Audit packs (SOC 2, ISO 27001 and EU AI Act evidence packs, /api/v1/audit/packs) | Partial | Several collectors query the wrong columns, so those controls always record zero and fail |
| Audit proof service (transparency-log proofs, timestamps, proof bundles) | Partial | Mounted only when an operator setting is present; one tree covers every organisation; without a configured key it signs with an ephemeral key |
Audit evidence store (/api/v1/audit/evidence) | Partial | Blobs are kept in memory and lost on restart |
Audit log retention setting (/api/v1/audit-logs/retention) | Stub | Held in memory, shared by every organisation, read by nothing. Retention is set by tiering instead |
Audit live stream (/api/v1/audit-logs/stream) | Stub | |
| Observability retention per organisation | Partial | Stored but not enforced |
Vendor connectors anthropic, openai, azure-openai, aws-bedrock, gcp, copilot, tabnine, gemini-workspace, m365-copilot, aws-q-developer | Working, with a known defect | Their event ids are not scoped to the organisation, so two organisations connecting the same vendor tenant can suppress each other's events. See Vendor connectors |