Audit, Taint & Compliance
Evidence you can hand to someone who does not trust you.
The audit chain
Six chained tables, built so that tampering is detectable rather than merely discouraged.
Hash chaining
Each record locks the last. A SHA-256 event hash, a prev_hash link to the record before it, and a per-row HMAC signature. Altering one entry breaks every entry after it.
Gapless ordering
Nothing quietly removed. A signed sequence number is the sole ordering key, so a deleted record leaves a hole that cannot be closed.
Independent verification
Ed25519. An asymmetric seal means a third party — your auditor, your regulator, your client — can verify records without CattleGrid's secret key and without taking our word for anything.
External time anchoring
Not our clock. RFC-3161 trusted timestamps and OpenTimestamps proofs anchor the chain to time sources outside our control, with an anchored high-water mark.
Customer-held archival
Your bucket. A nightly canonical export to your own S3-compatible storage. The evidence lives somewhere we cannot alter it, which is the point.
Verification tooling
Check it yourself. A verification API, plus a standalone external tool that runs independently of the platform.
What gets recorded
Who acted, when, from which session and device, which rules were evaluated and what action followed. Sensitive content is never stored in full — the log captures the event, not the data that triggered it.
Taint governance
AI agents call tools. Tools return content. That content reaches the model — and most governance never looks at it.
The problem
Tool output is untrusted input. A model that reads a web page, a ticket or a document is reading something nobody vetted. Instructions hidden in that content are the current front line.
Verdicts
Four outcomes. Every tool call and response carries a verdict — PASS, WARN, SANITISE or BLOCK — with thresholds you configure per tenant.
Approval workflow
Off by default. Tools are registered per tenant with role-based access. An unapproved tool cannot be invoked at all, and a blocked tool shows a clear reason rather than failing obscurely.
Semantic accumulation
Compound risk. Individually harmless tool responses can add up to something that is not. Accumulated taint across a session is caught before egress, not after.
Provenance graph
Show your working. A per-session causal graph of which sources were touched, which tools were called and where taint accumulated — so an incident can be reconstructed rather than guessed at.
Human checkpoints
A person in the loop. High-impact actions can be gated behind explicit approval, with a timeout that reverts to BLOCK. Silence is never taken as consent.
For compliance officers
A role with its own view, its own powers, and its own audit trail.
Conversation review
Tenant-wide. A compliance-officer-only view of every conversation and direct message across the organisation, with lifecycle state. Reading content is itself an audited act.
Freeze
Preserve an incident. Freeze and unfreeze conversations where something needs holding intact, fully audited in both directions.
Under encryption
Still accountable. Per-message tamper-evident metadata is retained even where end-to-end encryption is in force, so privacy and accountability are not a trade-off.
Subject access and erasure
UK GDPR, in practice. SAR redaction and fulfilment, plus retention-engine and admin-driven erasure under Article 17, with deletion certificates as evidence it happened.
Into your SIEM, not just our dashboard. Events are normalised to the OCSF schema and forwarded to your existing SIEM, or pulled via REST and NDJSON streaming. Compliance events have their own dashboard, and integrity verification can be run on demand.
Alerting reaches people where they already are — email, Slack, signed webhooks — with thresholds you set rather than ones we assume.
Switched on to suit you. Compliance review, conversation history, encryption mode and taint thresholds are all configured per account. What one organisation needs, another is obliged to avoid.
Assign and revoke the compliance-officer role yourself. It is a role model, not a support ticket. For how sensitive values are kept out of these records in the first place, see Anonymise.