Proof an examiner can verify without trusting the system that produced itProof verifiable without trusting the system
signed.payout.recordverified
proof_idprf_fe22c21f8edaed3d
packfinance/payout_approval
decisionDENY
input_hash9f3733c79830bc0a
key_iddemo_bank_ec_1
algorithmECDSA-P256-SHA256
verify a real record

Live signed record (synthetic payout case): really signed, really verifiable; verification fails if a single byte changes. More signed examples in the appendix.

RECORDED
2026·06·10

When the model or vendor changes, can you still prove this exact decision?

A denied applicant, a dismissed AML alert, a model-risk call. When the system that produced the decision has changed, the record has to stand on its own. Notary Cloud is an evidence-integrity layer that signs the decision event your system already made. It preserves an externally verifiable record of what was decided, on which inputs, and under which model and policy state, in a form that does not depend on the runtime that made the call. Under rules already in force, a creditor must give specific, accurate reasons for an adverse action even when the decision came from a complex or opaque model, and not understanding your own model is not a defense (CFPB Circular 2022-03). The signed record is what lets you show the stated reason matches what the model actually scored.

Verify a real record now. The sample page runs ECDSA P-256 verification in your browser against a public key served separately from the record, not held in the page. A second public record carries a daily batch root countersigned by an independent RFC 3161 timestamp authority — the token ships inside the record and verifies offline with openssl.

Notary Cloud does not decide, screen, approve, deny, or file SARs. It records decisions your systems already made.

ECDSA P-256 sampleAppend-only sequenceRFC 3161 batch anchoringUS + EU + CanadaLive in-browser verify
CHOOSE YOUR ENTRY

Three routes onto the record.

Same evidence layer underneath. Pick the path that matches how you would start. Each one ends in a signed, independently verifiable decision record.

ON THE PUBLIC RECORD

Where this argument is already dated.

Filed comments are not regulator endorsement. They are dated evidence of the category argument, anchored to rulemaking the whole market is tracking.

TODAY · 2026-06-04
2026-04-17
Federal Reserve SR 26-2 issued
On record
2026-06-09
FinCEN NPRM comments close
Upcoming · 5 days
2027-05-01
OSFI E-23 effective
Upcoming

Regulatory comments

Three public comments filed in the FinCEN AML/CFT and PPSI rulemaking dockets.

FINCEN-2026-0034FINCEN-2026-0100

Signed sample

notary-cloud.com/r/prf_fe22c21f8edaed3dVerified

ECDSA P-256 proof generated through the local enforce lifecycle, verified in-browser against a separately served public key.

Architecture

RECORD n-1 · prev hash
RECORD n · decision + signature
RECORD n+1 · append-only

Signing key held outside the producing runtime, public key retained separately; the record stays verifiable even if the runtime is gone. Deployer-held key custody is the pilot target mode; the public demo shows a deployer-labelled record verifying against a key served from a separate origin. The deployer can also declare the model and policy version inside the decision input; the declaration is hash-bound into the signed record, so it cannot be swapped after the fact. Notary Cloud records the declaration — it does not verify it. Both properties are live on the public demo records: declared versions visible on an anchored record, and a batch root countersigned by an independent RFC 3161 timestamp authority.

ECDSA P-256RFC 3161 anchoredAppend-onlyCustomer-held WORMVersion-binding
FOUNDER + STATUS

Credibility comes from restraint.

Notary Cloud is early. The public record, the live verifier, and the status labels are the trust surface.

  • Built by Sviatoslav Zhuravlev, the person who filed the FinCEN AML/CFT and PPSI rulemaking comments.
  • Pre-revenue. No paying customers and no completed pilots yet.
  • If Notary Cloud stops operating, an exported record and the retained public key can still be verified without re-running the runtime. Deployer-held key custody is the pilot target mode; today the pilot key is held by Notary Cloud, and the deployer-labelled demo record shows external-origin key verification.
  • The pre-revenue status is labelled plainly because this is evidence you may have to defend to your own examiner.
  • We label what is live and what is not, because an examiner will.
DIRECT PILOT

A concrete next step for a CCO or BSA officer.

Start with one decision class where the institution already carries examination risk: an automated adverse action such as a denial, an AML alert disposition, or a model-risk-relevant compliance call.

01

Scope

One consequential decision stream, one evidence schema, one verifier path.

ONE STREAM
02

Walk-away

A set of signed sample records, review notes, and a go/no-go production outline.

GO / NO-GO
03

Terms

90-day pilot shape. No annual lock-in. OEM pricing remains on the partner pricing page.

90-DAY SHAPE
ONE RECORD, THREE REGIMES

One verifiable AI decision record across US, EU, and Canada.

The legal tests differ. The evidence object is similar: a signed, externally verifiable AI decision record that lets an examiner reconstruct what was decided, under which model and policy state, without trusting the runtime that produced it.

US

Adverse-action + AML evidence

For credit and other adverse actions, ECOA and Regulation B require specific, accurate reasons regardless of how complex the model is (CFPB Circular 2022-03). A signed decision record lets the institution show the reason it gave matches what the system scored. The same record helps show what an AI-enabled AML/CFT process decided when program effectiveness is questioned.

ECOA / Reg BCFPB 2022-03
EU

EU AI Act Article 12 + 26

The same record shape supports lifecycle logging evidence and deployer reconciliation when a high-risk system's output must be reconstructed later.

AI Act Art. 12Art. 26
CA

OSFI E-23 + FINTRAC posture

Canadian model-risk and PCMLTFA / FINTRAC recordkeeping pressure points ask the same examination-time question: can the institution produce the record?

OSFI E-23PCMLTFA
HOW IT WORKS

Four moves from decision to externally verifiable record.

01

Upstream system decides

Your agent or model makes a decision inside your stack. Dismiss, escalate, hold - that call stays yours.

aml.screener -> sar_dismissed
02

Notary Cloud records

You send the decision with its rationale and inputs. We canonicalize the payload and write a signed audit record.

decision payload -> signed record
03

Record is signed

The record is signed by the configured signing key. This public sample uses ECDSA P-256.

signature + key_id
04

Batch root is anchored

Daily record batches are hashed into a Merkle root and timestamped through an RFC 3161 TSA endpoint. The public demo record carries a countersigned root you can verify offline. The job must run; anchoring is not magic.

daily_root + tsa_url
FIELD CONTROL

What each field in the record is for.

A signed record is only useful if each field answers a question an examiner actually asks. Each field below maps to a specific evidentiary requirement, not to a compliance badge.

signed_record = {
model_version, policy_version: "v4.2 / p18",
Model-risk reconstruction

Versions the deployer declared at decision time, hash-bound into the signed record so they cannot be swapped afterward. Visible on the public demo record. The declaration is recorded, not verified.

SR 11-7 / SR 26-2OSFI E-23
input_hash: "7d35c7ba…9417",
Adverse-action reason-match

That the stated reason for the decision matches what the model actually scored.

ECOA / Reg BCFPB 2022-03
timestamp: "2026-05-18T13:28:36Z",
Lifecycle logging

When the record was created, provable by a third party.

EU AI Act Art. 12
signature: "MEUCIHvV…" // ECDSA P-256
Non-repudiation

That the record has not changed since creation and comes from the deployer's key.

NIST 800-53 AU-10
sequence: 418823 // append-only
Record-alteration detection

That the record cannot be quietly rewritten or deleted after the fact.

}

These are evidentiary mappings, not compliance certifications. The record supports each requirement; it does not by itself satisfy it.

INSTITUTIONAL CHANGE

The system on file is rarely the system that produced the record.

Per-decision evidence is not enough if the institution cannot later show which system, model, policy, vendor, and custody state existed when the decision was made.

Examination question

You switched vendors last year. Can you still produce the evidence for a decision the old vendor's system made?

Preservation duties and lifecycle logging duties can collide with data-minimization and erasure duties. Lifecycle logging says little about who controls the logs after the system changes hands.

01

Adoption is a representation.

A procurement memo, model inventory entry, or vendor statement says what was adopted. It does not guarantee the evidence environment will still exist when the decision is examined.

02

The system changes.

Models retrain, policies revise, retention changes, vendors switch, and custody moves. The system on file is rarely the system that produced the record.

03

The evidence splits.

When the model, the policy, or the vendor changes, the evidence does not move cleanly with it. It splits across parties, systems, and retention duties.

Notary Cloud's public posture is narrower: record the decision event outside the producing runtime, use an independent signing key held outside that runtime, and keep the resulting record externally verifiable. This section states the institutional evidence gap, not a solution design.

FAILURE SCENARIO

The cost appears when the examiner asks for the record.

A sober version of the downside: not a breach, not a headline, just an institution unable to prove the state of a consequential AI decision.

The institution produces a vendor export from the current system. The decision was made by the old system.

vendor_export.csvcurrent system
MISMATCH
decision_record · v1_modelold system · gone

The reviewer can see a row, but cannot independently test whether the row is complete, whether the policy state matches the date, or whether the export changed after the vendor migration. Mutable logs can still be useful. They are weaker evidence when the institution carries the burden of reconstruction.

ROUTES

Find the right surface fast.

Different buyers need different proof. The site routes to existing detail instead of duplicating it.

PILOT REQUEST

Scope a pilot around one decision class.

Use the form when email is too much friction. Mail remains available for security review threads and attachments.

Email instead

Form submissions are emailed to the project inbox. Do not include secrets or customer data. Read the pilot protocol.

EXAMINATION TIME

Admissibility is a later decision.

The record matters when a reviewer asks whether the evidence survived the system, vendor, policy, and custody state that produced it.

01

Examination-time evidence

Runtime authority decides whether an action can bind consequence now. Notary Cloud records what was decided so a later examiner, auditor, or court can test the record without trusting that runtime.

02

Company-disappearance risk

If the deployer retains the signed record and public key, verification does not require Notary Cloud to re-run the decision system or cooperate with the vendor that produced it. And when WORM replication is configured, the evidence is not only verifiable without us — it sits physically in the institution's own write-once storage, under its own retention lock.

03

Complementary slot

The record is not a SIEM, model monitor, case manager, or approval engine. It is the witness layer for consequential decision events.

Witness-layer position
PUBLIC VERIFY

Each signed record gets a verifier URL your examiner can open.

Share a record with an examiner, a counterparty, or your CCO. The public page verifies the signature client-side. It shows proof fields, the canonical string, and the public key URL. It does not prove semantic truth of the underlying decision.

  • Signed proof ID in the URL
  • Signature validated in the reader's browser
  • Canonical string visible
  • Payload PII excluded through allowlist
View sample record
Signed record
DECISION RECORD
prf_fe22c21f8edaed3d
Signed
Pack
finance 1.1.0
Intent
payout_approval
Decision
DENY
Key
demo_bank_ec_1
Recorded
2026-06-10T21:54:27.248Z
Algorithm
ECDSA-P256-SHA256
SIGNATURE
MEUCIHvV2y5m+pWq9EiEepN7/AXdy/XooKUXBrReRdJZH3ZlAiEAzaEacCSXgOr22KZyF8QipS/SgGgOQlZ6QirRktc3hHg=
LIVE BACKEND

The pipeline is running. Verify it yourself.

A hosted Notary Cloud backend produced the pilot record below through the full live pipeline: enforce, ECDSA P-256 signing, a daily Merkle root, and an RFC 3161 timestamp from an independent authority. Every artifact is public — check each one without trusting us.

Checking backend status…
01
Open the pilot record and verify its signature in your browser

WebCrypto recomputes the ECDSA P-256 check locally against the public key; flip one byte and verification fails. The record carries the declared model and policy version (hash-bound via input_hash) and the countersigned batch root.

Open record prf_29dcc501b0a7821a
02
Fetch the public key from the live backend

The signing key's public half is served by the backend's well-known endpoint — the same URL the record page uses for verification.

render_demo_proof_1.pem
03
Check the public transparency root

The daily Merkle root covering the record, with its RFC 3161 token, is public — no account, no key. The anchor proves the record existed no later than registration time.

/v1/transparency/2026-07-04

The pilot record is synthetic and signed by a Notary Cloud pilot key — it demonstrates the live pipeline mechanics. Deployer-held key custody is a separate property, demonstrated by the Demo Bank-labelled record, whose key is served from an origin outside the backend. Two records, two properties.

LIVE WRITE DEMO · ISOLATED SANDBOX

Watch the pipeline sign a record, live in the console.

Pick one of the synthetic cases and hit run. The sandbox checks it against the finance pack, decides ALLOW or DENY, and signs the record with ECDSA P-256, one line at a time in the console. Then verify that signature yourself, or change one byte and watch it break.

notary · sandbox · zsh · 96×30IDLE
pick a case, then Run enforce
This runs on an isolated sandbox with an ephemeral demo key, not a production key. The record is not anchored, and it disappears when the sandbox restarts. Anchoring (RFC 3161) is on the production record prf_29dcc501b0a7821a, and deployer-held key custody on the Demo Bank-labelled record. Two records, two properties.
CHAINS

One chain per decision stream.

Each stream of consequential AI decisions gets its own chain. The engine is universal - chains define the shape of a valid record and the events that belong in that stream.

AML Screening
v1.0.0
active

Records SAR-relevant decisions - dismissed, escalated, filed - with the rationale and inputs a BSA examiner would expect.

sar_dismissed, sar_escalated, sar_filedScope a pilot
Sanctions
v0.3.0
planned

Records OFAC list-match reviews and the rationale for each dismissal or freeze.

ofac_match_reviewednotify me
Transaction Monitoring
v0.2.0
planned

Records threshold-triggered alerts and how they were resolved across the case lifecycle.

alert_resolved, alert_escalatednotify me
HOW IT HOLDS UP

Built for the question an examiner asks in month six.

Each row names a structural control. Some are live in code today. The honest ones say what is not.

See signed proof
  1. 01
    CRYPTOLIVE WHEN CONFIGURED
    Configurable signing

    Records are signed by the configured proof key. ECDSA P-256 is implemented when key directories are configured; HMAC remains the default dev and legacy path.

    Maps to: agent output provenance; NIST 800-53 AU-10 (non-repudiation)

  2. 02
    INTEGRITYLIVE
    Append-only record storage

    Records get monotonic sequence numbers and database-level append-only enforcement. UPDATE and DELETE are blocked on the signed-record tables under row-level security. Do not confuse this with a per-record blockchain.

    Maps to: record alteration detection

  3. 03
    STORAGELIVE WHEN CONFIGURED
    Customer-held WORM retention

    When the customer's Object-Lock bucket is configured, signed records replicate into it (write-once retention), so the bytes sit under the institution's retention control, not ours. Deleting or rewriting a record inside the retention window is blocked by the customer's storage layer itself.

    Maps to: record retention; record-alteration detection (storage layer)

  4. 04
    TIMESTAMPLIVE — ON THE DEMO RECORD
    Merkle + RFC 3161

    Daily batches are hashed into a Merkle root and countersigned by an independent RFC 3161 timestamp authority. The public demo record carries the token; it verifies offline with openssl. The anchor proves the record existed no later than registration time. Fallback endpoints are configurable; none ships as a built-in default.

    Maps to: time-of-record evidence

  5. 05
    AVAILABILITYLIVE
    Fail-closed validation

    Records with unknown chains, missing required fields, or malformed rationale are rejected before storage. The upstream decision remains yours.

    Maps to: invalid action rejection

  6. 06
    PRIVACYLIVE
    AES-256-GCM encryption at rest

    Stored enforce payloads and evidence blobs are encrypted with AES-256-GCM before storage.

    Maps to: payload confidentiality

  7. 07
    ISOLATIONLIVE
    Tenant isolation

    Row-level security and FORCE RLS separate tenant records from runtime roles.

    Maps to: tenant boundary

  8. 08
    PRIVACYPARTLY LIVE
    Payload minimization

    The public sample exposes only fields needed for verification. Customer schemas still need explicit allowlists before any real customer record is public.

    Maps to: data minimization

  9. 09
    OWNERSHIPLIVE IN RECORD DESIGN
    Deployer-controlled record

    The record sits in the deployer's evidence layer, not the vendor's runtime. Exportable, reconcilable, contract-independent of vendor terms.

    Maps to: vendor runtime boundary

  10. 10
    OPERATIONSPLANNED
    Transparency surfaces

    Public status, incident history, and key rotation log are not live today. They should ship before any production pilot claim.

    Maps to: security transparency

BUILD VS BUY

Why not just log it yourself?

This objection is valid. The gap is structural, not about whether your team can write logs.

01

Self-attested vs independently provable.

An in-house log is signed, if at all, by the same party being audited. Notary Cloud's record is signed with a key held outside the system that produced the decision and is verifiable by a third party without taking the deployer's word for it.

02

Lives inside the system under audit.

In-house logs sit in the same runtime or database that produced the decision, so they can be changed, rotated, or lost by whoever controls that system. The Notary Cloud record survives independently of that runtime.

03

Verifiable without trusting your infrastructure.

An examiner or counterparty can confirm a Notary Cloud record is authentic and unaltered without trusting your logging stack, your retention policy, or your word. A homegrown log requires them to trust all three.

04

Vendor-held key vs institution-held key.

A vendor can also sign the record for you and hold the key. That answers tampering, but it leaves two things with the vendor: the record stays verifiable only while the vendor keeps signing, and new evidence can only be produced while you keep that vendor. Independence of the signer is bought at the cost of dependence for production. Holding the key inside the institution keeps both the production of new records and their verification on your side, while anyone can still check a record against the published key. The independent check is the verifier, not the vendor.

Building the pipeline is easy. Producing evidence that holds up when the system that made the decision is the thing under question is the part teams cannot build by adding more logging.

QUESTIONS

Answers to what compliance teams actually ask.

Rules already in force require specific, accurate reasons for an adverse action even when a complex or opaque model produced it, and a creditor's failure to understand its own model is not a defense (CFPB Circular 2022-03). Notary Cloud does not write your adverse-action notice and does not judge whether the decision was fair. It records, outside the system that decided, what was decided, on which inputs, and under which model and policy state, so you can later show the reason you gave matches what the model actually scored. That is the part an in-house log cannot prove on its own, because it is signed by the same system under question. Open a verifiable appendix example.

No. You already have screeners, case managers, and monitoring systems. Notary Cloud records what those systems decided, in a form your examiner can reconstruct. We are the evidence layer underneath your existing stack, not a replacement for it.

The April 2026 NPRM credits institutions whose AI tools help demonstrate AML/CFT program effectiveness. Adoption alone gets no credit. Verifiable evidence of effectiveness is the kind of demonstration an effectiveness-based approach calls for.

Signing is synchronous. Anchoring is asynchronous and should not block the upstream decision. I will publish latency numbers only with a dated benchmark artifact, because made-up p50/p99 claims are worse than no numbers.

Your decision still happens. What is at risk is the record. A pilot design should decide whether to queue records locally and replay them later, or fail-closed on recording for high-risk decisions. That is a customer risk decision, not ours to hide.

Not today. Customer co-signing and BYOK are roadmap items. HSM/KMS-backed signing is not live in the current product.

Most of this site speaks to compliance officers at US banks and fintechs. If you build AI compliance agents that those institutions buy, the partner pages explain how Notary Cloud sits under your product as an evidence layer. Direct, co-brand, and white-label options are scoped during the pilot.

Internal audit cannot reconstruct AI decisions when the audit trail is produced by the same runtime that made the decisions. Notary Cloud records the decision event outside that runtime, in a form internal audit can read, verify, and reconcile against the platform's own surface. This is the artifact independent assurance needs when AI sits in the decision path.

Different layer, different time scale. Runtime enforcement platforms decide at the moment of execution whether an AI-initiated action is allowed to proceed. Notary Cloud decides nothing at runtime. It produces a record of what was decided that an examiner can verify months later without trusting the runtime that produced it. Both are decisional. Runtime enforcement is decisional at execution time. The externally verifiable record is decisional at examination time, because what a regulator or court will accept depends on whether the record survives the system that wrote it. These are complementary slots, not competing ones.

No, and the reason is specific. The assurance does not come from who holds the signing key. It comes from two things a reviewer can check without taking anyone's word: the record is tamper-evident and append-only, and its signature verifies against a public key served from a separate origin, not from inside the system that made the decision. Anyone can fetch that key and verify the record independently. Holding the key inside the institution is also what keeps the evidence under the institution's own control, the control Article 12 of the EU AI Act asks for, instead of depending on a vendor to keep producing new records. Where the timing of the record itself has to be provable by a third party, batch roots are countersigned by an independent RFC 3161 timestamp authority — shown countersigned on the public demo record, verifiable offline.

Your core makes decisions. Your SIEM collects logs. We sit between them for decisions a regulator could later question - recording the decision, the rationale, and the inputs in a form the SIEM and the core cannot quietly rewrite. We complement both, not replace either.

The structural problem is the same. Canadian federally regulated financial institutions operate under OSFI E-23 for model risk management and under PCMLTFA recordkeeping requirements that FINTRAC can request on examination. A signed, externally verifiable record of what an AI system decided, on what inputs, under which declared model version, holds up under those exam postures the same way it holds up under FinCEN or EU AI Act scrutiny. Independent signing key, append-only record storage, RFC 3161 batch anchoring. The architecture does not depend on which regulator is asking.

OSFI E-23 requires federally regulated financial institutions to demonstrate model risk management across the model lifecycle, including documentation that an examiner can use to reconstruct what a model did and why. Where AI sits in a decision path, the same record fields matter: declared model version, policy state, input hash, decision label, and timestamp. Notary Cloud records those as a signed event — the versions are what the institution declared at decision time, hash-bound so they cannot be rewritten later — that the institution can produce on examination without depending on whichever vendor runtime made the call. This is the same artifact that supports SR 11-7 reconstruction in the US.