Enterprise-grade compliance

Tamper-evident audit trails your compliance team can verify

Cryptographic proof of every AI action. Meet Quebec Law 25, Treasury Board DADM, and Health Canada requirements with hash-chained audit trails that are mathematically tamper-evident.

loan_processor.py
Audit Trail
loan-processor
Drop-in integrations for every major AI framework
🦜LangChain
πŸ•ΈοΈLangGraph
βš™οΈOpenAI Agents
🧠Anthropic SDK
πŸš€CrewAI
πŸ€–AG2 / AutoGen
πŸ“‘MCP Protocol
πŸ”OpenTelemetry
πŸ€–Claude Code
πŸ“‘mcp-use
🦾OpenClaw
Features

Built for trust.
Designed for developers.

Every agent action is captured, hashed, and verified. Provenlog gives you a cryptographic proof of what your AI did β€” and didn't do.

Hash Chain Integrity

SHA-256 linked events form a tamper-evident chain. Modify any event and every subsequent hash breaks β€” instantly detectable.

Merkle Tree Verification

A single root hash represents the integrity state of every agent chain. One hash to verify them all.

PII / PHI Redaction

17 built-in patterns scrub emails, SSNs, credit cards, API keys, and more β€” before data hits the audit trail.

Web Dashboard

Built-in React UI for exploring events, monitoring agents in real time, and verifying chain health at a glance.

Framework-Native

1-2 line integrations for LangChain, CrewAI, OpenAI Agents, Anthropic, AG2, and LangGraph. Zero behavior changes.

Embedded or Server

Start with local SQLite β€” no infrastructure needed. Scale to a server when you need multi-agent dashboards and API access.

Canadian Compliance

Built for the frameworks that matter

Provenlog's tamper-evident audit trails map directly to Canadian regulatory requirements β€” from Quebec privacy law to federal AI governance.

Quebec Law 25

Automated decision notification and explanation requirements under Quebec's privacy law. Penalties up to 4% of global revenue. Fully enforceable now.

Treasury Board DADM

Federal Algorithmic Impact Assessment with Β§6.3.11 anti-tampering requirement β€” a direct hash-chain mandate. Compliance deadline: June 2026.

Health Canada MLMD

Audit trail and Privacy Impact Assessment requirements for AI medical devices and clinical AI scribes. Provincial health data laws enforce up to $1M penalties.

PIPEDA

Canada's federal privacy law β€” 10 Fair Information Principles with 24-month breach record retention requirements. Applies to all private-sector organizations.

Industries

Trusted across regulated industries

Every industry deploying AI agents needs proof of what those agents did. Provenlog provides it.

saasFintech-audit.json
{ "agent": "credit-scoring-agent", "action": "evaluate_application", "applicant_id": "[REDACTED_PII]", "decision": "declined", "decision_reason": "Debt-to-income ratio exceeds threshold", "compliance_check": "PASSED - Law 25 Β§12.1", "hash": "e3b0c44298fc...b7852b855" }
Verified
Architecture

From action to proof in milliseconds

Every agent action flows through a pipeline that validates, redacts sensitive data, and cryptographically seals each event into a hash chain.

Capture
Agent SDK captures the action
β†’
Validate
Schema and field validation
β†’
Redact PII
17 patterns scrub sensitive data
β†’
Hash Chain
SHA-256 linked to previous event
β†’
Store
Append-only immutable storage
Policy Engine

Compliance rules your team can read

Define enforcement policies in plain English. ProvenLog evaluates every agent event in real time β€” no code required.

tool-call-must-have-resultRule 1
When Action Type is a tool call, a tool result must follow within 60s.

Ships with built-in policies. Define your own in YAML.

Developer Experience

Integrate in minutes,
not days.

Every integration is a thin callback wrapper. Provenlog observes passively β€” it never modifies agent behavior and adds zero latency to execution.

  • βœ“Zero-code CLI wrapper (plog run)
  • βœ“One-line auto-instrumentation (import provenlog.auto)
  • βœ“Native hooks for Claude Code, mcp-use, and OpenClaw
  • βœ“Works embedded (SQLite) or remote (HTTP)
  • βœ“Automatic PII/PHI redaction
# Wrap any Python agent with plog run
# Automatically detects and instruments all frameworks
Β 
plog run -- python my_agent.py
Β 
# Or specify an agent ID and server
plog run --agent-id my-agent --server http://localhost:7600 -- python script.py
Integrity

Every event, cryptographically sealed

Each event's hash depends on the previous. Tamper with one and the entire chain breaks β€” instantly, mathematically detectable.

#1

TOOL_CALL Β· search_database

agent-codegen-01 Β· 2ms ago

a3f7c2...e91b
#2

TOOL_RESULT Β· search_database

agent-codegen-01 Β· 1ms ago

7d2e84...f4a0
#3

LLM_CALL Β· claude-sonnet-4-5-20250929

agent-codegen-01 Β· just now

b8f1d3...2c7e
#4

LLM_RESPONSE Β· claude-sonnet-4-5-20250929

agent-codegen-01 Β· now

e5c9a1...8d3f
Enterprise Features

Everything you need for
production compliance

Provenlog provides the controls, visibility, and integrations regulated organizations require.

Compliance Reporting

Generate audit reports mapped to Law 25, DADM, Health Canada, and PIPEDA requirements. Export-ready for regulators.

SSO & Role-Based Access

SAML/OIDC single sign-on and granular RBAC. Control who can view, query, and export audit data.

Configurable Retention

Set retention policies per agent, team, or compliance requirement. Automated archival with full chain integrity.

Anomaly Detection

Real-time alerts for unusual agent behavior patterns, chain integrity breaks, and access anomalies.

Enterprise Dashboard

Multi-agent monitoring, cross-team visibility, and org-wide integrity status in a single pane of glass.

Audit Export

Export complete audit trails in JSON, CSV, or PDF. Cryptographic verification metadata included for independent validation.

Trust Architecture

Mathematical integrity, not just promises

Provenlog doesn't just log β€” it creates a cryptographic proof chain that's independently verifiable by auditors, regulators, and your own compliance team.

Merkle Tree Verification

Cryptographic proof of your agent's activity log.

ROOT: 8a2b...9f1c
HASH: 3c4d...1a2b
HASH: 7e8f...5c6d
Event 1
Event 2
Event 3
Event 4

Cryptographic Hash Chain

Every agent action is hashed using SHA-256, chaining each event to the previous. Modify any record and every subsequent hash breaks β€” providing mathematical proof of tampering.

Merkle Tree Integrity

All agent chains roll up into a single Merkle root hash. One value represents the integrity state of your entire AI fleet β€” verifiable in constant time.

Immutable Append-Only Storage

Events can never be modified or deleted once written. The audit trail is a permanent, ordered record of every decision your AI agents made.

Ready to secure your AI audit trail?

Talk to our team about compliance requirements, deployment options, and how Provenlog fits your infrastructure.