The proof layer for AI
AI decisions you can prove.
Verdifax converts AI execution into independently verifiable proof, auditable by regulators, courts, and counterparties.
The problem
AI systems make decisions that affect money, health, and national security.
When those decisions are questioned, there is no reliable way to prove what happened. Logs can be altered. Models can’t explain themselves. Evidence breaks the moment it’s needed most.
The proof
Every decision, sealed into something an outsider can verify.
Verdifax takes what a system submits about an AI decision after its own model call, seals it into a cryptographic artifact, and anchors it on a public log. From run 238 on (2026-10-16, 17:06 UTC) the anchor covers every section of a successful run's record; earlier records anchor the run's identity and core values only. Anyone can check what is anchored without trusting our servers, the model, or the operator's database; the public-log checks rely on Verdifax's published log-signing keys.
- Step 1Input
- Step 2Decision
- Step 3Execution
- Step 4Evidence
- Step 5Seal
- Step 6Verifiable Hash
The hash is the seal. Change an anchored value and the public-log entry stops matching.
Who it’s for
Built for institutions that cannot afford to be wrong.
01
Defense & Intelligence
Targeting decisions, sensor fusion, and intelligence summarization backed by sealed, independently verifiable records.
02
Healthcare
Clinical AI decisions backed by sealed records, with each run's anchored values on a public log, that customers can use as evidence for their own 45 CFR § 164.312(b) audit controls.
03
Financial Services
Credit, AML, and trading models with each run's anchored values on a public log, which customers can use for their own SOX § 404 controls and ISO/IEC 42001 management systems.
04
Federal Civilian
Sealed records, with each run's anchored values on a public log, that support the logging duties providers and deployers carry under the EU AI Act and outcomes in the voluntary NIST AI RMF. Verdifax is not FedRAMP certified.
The difference
Logs ask you to trust. Verdifax lets you verify.
Others
Verdifax
Logs
Cryptographic proof
Trust the vendor
Verify independently
Explanations
Evidence
Best-effort audit trail
Sealed manifest hash
Technical foundations
Four properties that turn AI output into evidence.
Deterministic Execution
Replayed under a pinned clock and nonce, with the public-log stage held fixed, the pipeline computes the same manifest hash byte-for-byte, and a built-in replay check confirms it.
Independent Verification
Any third party can recompute every sealed section hash and the anchored Rekor leaves offline with the open-source verifier, confirm each section is bound to the same manifest hash, and, where a run carries one, re-check its AMD SEV-SNP hardware quote against AMD's own root of trust. These checks need no Verdifax credentials and do not rely on our servers; the public-log checks rely on Verdifax's published log-signing keys. On records sealed from run 239 on, every section shows it has not changed since anchoring, and on run 238 it does when the verdict is COMPLETE RECORD ANCHORED; on records before run 238 only the anchored values do, and the descriptive sections show only that the bundle is internally consistent.
Cryptographic Sealing
Each run's input, pipeline stages, and final artifact are collapsed into a single manifest hash. The run's identity and (since leaf v5) its 33 pre-anchor values are bound to a public-log entry, and from run 238 on, a second entry binds the complete record.
Public-Log Anchoring
Each run is publishable as an entry on Sigstore Rekor, a public, append-only transparency log that Verdifax does not operate. The entry binds the run's identity and, on records sealed since leaf v5, its 33 pre-anchor values. From run 238 on (2026-10-16, 17:06 UTC) a second entry binds every section of the record.
Outcome matrix
Six sealed outcomes. One verifier.
Every Verdifax run that completes or is stopped resolves to exactly one of six outcome states; a run that crashes is recorded separately and seals nothing. Each state is backed by its own cryptographically sealed artifact recording the rule, the data, and the cost. A completed run's audit bundle is checked offline with the open-source verdifax-verify, and so is a refused or halted run's receipt, including its own public-log entry for receipts issued from run 241 on (2026-10-16, 23:11 UTC).
Allow
Pre-execution policy passed. The run proceeds and produces a sealed AllowToken bound to the policy hash and the rule that admitted it.
Sealed artifact
AllowToken
Deny
Pre-execution policy rejected the request. A sealed DenyReceipt records the fired rule, decision reason, and policy hash. When Malicious Code Defense (MCD) matched a known threat signature, the receipt also carries that finding's hash.
Sealed artifact
DenyReceipt
CCV-Halt
Continuous Constraint Verification halted the run when the consumption the request declared exceeded its per-run budget (a token budget on the hosted API). The CCVHaltReceipt seals the partial execution at the halt point.
Sealed artifact
CCVHaltReceipt
MACC-Halt
Multi-Agent Coordination Constraint halted a run that would have taken its API key past its cumulative cross-run budget. The MACCHaltReceipt records the cumulative caller-declared consumption and the contributing run.
Sealed artifact
MACCHaltReceipt
AIVP-Halt
The AI governance review refused the AI output before an execution record was built. The AivpT4HaltReceipt records the review's decision, its reason code and the hash of the AI output.
Sealed artifact
AivpT4HaltReceipt
Attestation gap
Required attested fields were missing, so the request was refused at admission before the pipeline began. The AttestationGapReceipt names the missing fields and the policy that required them. The hosted API does not produce this outcome today: its baseline policy requires no attested fields.
Sealed artifact
AttestationGapReceipt
Specifications: PEPG_PSL_SPEC v0.2 (allow / deny / MCD-fail) · CCV_SPEC v0 (per-run budget halt) · MACC_SPEC v0 (cumulative tenant halt). Every allowed run's record carries a self-attested build provenance block (orchestrator version, git SHA, SLSA level, builder identity) that states which binary the operator says produced it. On successful runs sealed from run 238 on, the block is covered by the complete-record anchor on the public log; otherwise it is sealed inside the bundle only. Receipts for refused and halted runs carry no build provenance.
Three lines, then you have proof
Real product. Today.
Verdifax SDKs ship today for Python, Go, Node and R. Three lines of code turn any AI inference into a sealed, independently verifiable run.
import verdifax
receipt = verdifax.attest(
payload="loan application 4821",
program_id="...",
route_id="...",
registry_record_hash="...",
ai_output_text="Denied: DTI 52% exceeds 43% policy",
)
print(receipt.manifest_hash)Engage
Build AI you can defend.
Verdifax is built for regulated work in defense, healthcare, and financial services, and runs in production today. A hardware-attested evaluation endpoint is available on request; its log-signing key is not yet published in the verifier, so the public verifier does not yet accept its entries as Verdifax entries.
access@verdifax.com