OpenAI, Anthropic, Mistral, your internal APIs or any endpoint: Trust Layer sits between your agent and the API it calls. Every exchange becomes a proof, signed, timestamped by an independent authority and recorded in a public log. An audit trail anyone can verify without taking your word for it, or ours.
Real proof: verify it on trust.arkforge.tech
"Trust layer" means two different things. On vendor platforms it usually means a control layer: it filters requests, masks sensitive data and enforces guardrails before the model answers.
ArkForge Trust Layer is an evidence layer. It blocks nothing and changes nothing. It attests to what your agent actually sent, what it received, and when it happened. The two approaches work together: one limits what an agent can do, the other lets you show what it did.
That evidence is what goes missing once agents act on their own. In front of an auditor, a customer or a provider, "our logs say" is not enough, because you are the one writing those logs.
A log proves you recorded something. A Trust Layer proof shows what passed between your agent and the API, to a third party with no reason to trust you.
| An auditor asks | Application log | Trust Layer proof |
|---|---|---|
| Who wrote the record? | Your own server | The proxy, while the exchange is in transit |
| Would a later edit show? | No, write access is enough | Yes: the signature and the log entry no longer match |
| Who vouches for the time? | Your server's clock | An independent timestamping authority (RFC 3161) |
| Can a third party verify alone? | No, they have to trust you | Yes, with the timestamping authority and Sigstore Rekor |
| Is the response covered? | Only if you logged it | Yes: request and response fingerprints |
They run in transit, in this order. The API response comes back to you untouched, with the proof attached alongside.
SHA-256 fingerprints of the request and the response are bound together and signed with Ed25519. Altering either side breaks the signature.
An RFC 3161 token is requested from a WebTrust-certified provider (FreeTSA, DigiCert, Sectigo). The time is sealed with the content, not stored separately.
The entry is recorded in Sigstore Rekor, an append-only log. Its index is part of the proof. No account is needed to verify.
High-risk systems must automatically record events (Article 12), and deployers must keep those logs for at least six months (Article 26). Records a third party can verify carry more weight in an inspection than internal logs.
The logging paradox: GDPR vs the EU AI ActA provider bills calls or tokens you dispute. With every response fingerprinted and timestamped by a third party, you can show what was actually delivered, and when.
Agent A hands off to B, B hands off to C, and the final result is disputed. A proof at each hop shows what each agent received and returned, so you can see where the data changed.
Hallucination chains across agentsWhen an agent calls a tool over MCP, the proof works as a receipt: which tool, which parameters, which response, at what time.
How to build an audit trail for MCP tool callsPoint your HTTP client at the proxy and add your key. The rest of your code stays as it is.
Works with LangChain, AutoGen, CrewAI and any HTTP client. Open source (MIT) on GitHub.
No. Logs are for debugging. A proof is for showing someone else what happened, without asking them to take your word for it.
No. The timestamp comes from an independent authority and the entry is recorded in Sigstore Rekor, a public log. Both can be checked with them directly. The code is open source (MIT).
No tool makes you compliant on its own. Trust Layer produces verifiable records that support the documentation required by Articles 12 and 26. These obligations apply from 2 December 2027 for Annex III high-risk systems, and from 2 August 2028 for systems embedded in regulated products.
They are issued under RFC 3161 by WebTrust-certified providers. They are not qualified electronic timestamps under the eIDAS regulation. For formal legal proceedings, have your use case reviewed by a lawyer.
Any HTTP endpoint: model providers, internal APIs, third-party services. Trust Layer is not tied to any model or provider.
The Free plan includes 500 proofs per month, no credit card. Pro: EUR 29/month for 5,000 proofs. Enterprise: EUR 149/month for 50,000 proofs. See all plans.
500 free proofs per month, no credit card.