Signed Records, Clear Scope

Seal records a decision made at the gateway. It evaluates configured policy before the provider call and returns a signed ATTESTATION-v1 record for the routed outcome.

That record can support an evidence review. It is not a certification, legal opinion, or replacement for the controls your organisation must design and operate.

What the record is for

For a defined workflow, a reviewer can use the record to ask practical questions:

  • Was this call allowed or stopped at the gateway?
  • Which policy outcome was recorded?
  • Has the record changed since it was signed?
  • Can the signature be verified against a trusted public key without relying on Aqta?

The dashboard helps investigate a workflow. Independent verification checks the signed record itself.

What Seal does not establish

  • It does not certify a system as compliant with the EU AI Act, DORA, GDPR, HIPAA, or any other regime.
  • It does not determine whether a use case is lawful or whether a control is sufficient.
  • It does not replace human oversight, incident handling, supplier management, retention decisions, or the customer's own audit process.
  • A receipt proves the signed gateway record, not every fact about an application outside that call path.

A useful review loop

  1. Choose one repeated workflow where a reviewer currently reconstructs what happened after the fact.
  2. Agree the policy and the person who must trust the result.
  3. Route the workflow through Seal.
  4. Check the resulting record independently and include it in the existing evidence process.
  5. Decide whether the recurring review problem has become easier to resolve.

This is the relevant test for frameworks such as the EU AI Act or DORA: whether the record helps a real control owner carry out a real review. Regulatory applicability and control design remain your responsibility.

Verification

Receipts use Ed25519 signatures over canonical JSON. The current key is published at:

text
https://api.aqta.ai/v1/attestation/public-key

Key history is published at:

text
https://api.aqta.ai/v1/attestation/keys

Pin a trusted key in your verification process. The public endpoints describe Aqta's keys; your verifier must still enforce the trust and revocation policy you choose.

Talk through a workflow

For a pilot, bring the repeated workaround, the action it surrounds, and the reviewer who must trust it. hello@aqta.ai

Last updated: May 2026