Product · capture · receipt · pack

One capture layer.
Every agent.
Every regulation.

Three things in one: a hardened source-available SDK, a managed ingestion API, and a catalogue of jurisdictional export packs that regulators, insurers and auditors actually accept.

Start free See pricing
UK & EU residency Source-available SDK SHA-256 hash chain RFC 3161 notarisation
sha256:8f2a4b0c91e2d3a5b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0 sha256:1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d
§ IThe Capture Layer

Drop-in for the agent stack you already run.

Wrap OpenAI Agents SDK, Claude Agent SDK, MCP, LangChain, CrewAI, or any bespoke agent in one line. Every tool call, model call, sub-agent spawn, decision and external action becomes a tamper-evident receipt.

  • Source-available — your security team can audit the SDK end-to-end
  • Async non-blocking transport — never slows your agent
  • Local disk buffer for offline or air-gapped operation
  • Inline PII redaction — raw data never leaves your perimeter
  • Customer-held signing keys at the enterprise tier
Explore the SDK →
python · 5-line install
# pip install agentaudits

import agentaudit



agentaudit.init(

    api_key="aa_live_...",

    agent_id="claims_triage_v3",

)



# Your agent runs as normal —

# Agent Audit captures every action.

agent.run(customer_query)



# When the regulator asks, you have

# 1 click to an evidence pack.
receipt · v1 · evt_8f2a4b…
{

  "event_id":      "evt_8f2a4b...",

  "agent_id":      "claims_triage_v3",

  "ts":            "2026-06-07T14:23Z",

  "action": {

    "type":        "tool_call",

    "name":        "lookup_customer",

    "params_hash": "sha256:a1b2..."

  },

  "resource": {

    "classification": ["PII", "financial"]

  },

  "redacted_input":  "lookup [REDACTED]",

  "redacted_output": "{age: 34, ...}",

  "prev_hash":      "sha256:c4d2...",

  "signature":      "30450221..."

}
§ IIThe Receipt

A unit of evidence your auditor recognises.

Each receipt is a small, signed JSON object containing only what an auditor needs to understand the action. Sensitive payloads are fingerprinted, not stored — the hash proves the data existed; redaction proves you didn't keep it.

  • SHA-256 hash chain — retroactive edits are mathematically detectable
  • ECDSA signature — bound to your tenant's customer-held key
  • Schema v1, version-locked — never breaks downstream tooling
  • Optional hourly RFC 3161 notarisation — court-admissible proof
§ IIIThe Operator Surface

Every agent's life, queryable in seconds.

"Show me every action this agent took on this customer between these dates" is the primary query — and the one your existing logs can't answer.

№CapabilityWhat it does
01 Span-tree drill-down Each session renders as a tree of agent → sub-agent → tool calls, with input, output, decisions, classification, latency and cost inspectable on every node.
02 Filter by anything Agent, session, customer ID, data class, decision outcome, error, time range. All composable, all sub-second.
03 Verify integrity on demand One click runs the full hash-chain verification across any range of receipts. Pass / fail is shown alongside the first break index for forensic precision.
04 Anomaly alerts Decision drift, unauthorised tool calls, data-class escalations and spend spikes are surfaced automatically and pushed to Slack or Microsoft Teams.
05 SIEM integrations Webhook events into Splunk, Datadog, Microsoft Sentinel and Elastic — receipts live in your existing security telemetry pipeline.
06 UK data residency Default storage is London. Bring-your-own S3 and full self-hosted options at the enterprise tier — your data stays where your DPO says it should.
See the dashboard in detail →
§ IVThe Moat

The compliance answer your regulator already wants.

We maintain the export pack catalogue jurisdiction by jurisdiction. As regulations evolve, the packs evolve with them — no spreadsheet rewrites, no Excel macros, no consultant rebuilds.

№ 01 EU AI Act Article 12 High-risk system record-keeping evidence covering every operational obligation under Article 12. Available
№ 02 ICO Subject Access Every action involving a named data subject + lawful basis. Article 22 ADM disclosures included. Available
№ 03 FCA SYSC Operational resilience evidence demonstrating AI-driven service continuity for FCA-regulated UK firms. Available
№ 04 NIST AI RMF Govern / Map / Measure / Manage evidence pack for US enterprise diligence. Available
№ 05 Insurance claim pack Cyber and E&O policy claim evidence — incident timeline + affected receipts. Available
№ 06 Board / Audit Committee Quarterly governance summary, anomaly review, material decisions logged. Available
See every pack →

See it run against your stack.

Sign up for a free account, drop the SDK into a copy of your agent code, and watch the receipts flow into the dashboard. When you're ready, generate the EU AI Act Article 12 pack and hand it to your auditor.

Start free → See pricing