Evidence Vault is now live. Every certified attestation, approved AI Impact Assessment, shadow-AI decision, and weekly governance health report is sealed into write-once storage the moment it happens, with live integrity checks, a weekly signed digest chain, and signed auditor bundles that verify offline with standard tools.
The hardest question in AI governance is not “do you have a policy.” It is “show me.” Show me the attestation that was certified, the assessment that was approved, the decision that was made about that tool, and prove that none of it was edited after the fact. Evidence assembled for an audit is, by definition, assembled after the fact. It proves that someone prepared a file. It does not prove that the governance event happened as recorded.
Evidence Vault reverses that order. The record is a consequence of the event itself, and anyone you hand it to can check it.
Every time an attestation is certified, an AI Impact Assessment is approved, a shadow-AI application is sanctioned, flagged, ignored, or reopened, or the weekly governance health report runs, PulseAI seals a record of that event into write-once storage, encrypted under your organization’s own key. There is no “save evidence” button, and nobody is asked to file anything.
The framework and clause mappings that were active when the event happened travel inside the record, frozen at capture time. An attestation certified while OSFI E-23 is active carries its E-23 sections permanently, whatever changes in your framework configuration later.
Each record sits under a compliance-mode retention lock. For the lock’s term, no one can alter or delete it: not a tenant administrator, not a PulseAI operator, not even the root user of the hosting account. Retention profiles run from three to ten years (Canada baseline 7 years, EU AI Act provider 10 years, US HIPAA 6 years, global minimum 3 years), and in production the storage lock runs for the full term of your profile.
Every record shows two dates on purpose. Locked until is the storage lock actually enforced. Retain until is the business retention your compliance profile requires. They answer different questions, and the ledger never conflates them.
Open any record and press Verify integrity. PulseAI fetches the exact stored version named in the record’s receipt and recomputes its hash against that receipt, while you watch. The result is never cached and never precomputed. A green check you did not just run would be a claim you could not falsify, which is precisely what this feature exists to replace.
The searchable ledger is not itself write-once, so once a week PulseAI seals a signed digest of your organization’s complete receipt set and diffs it against the previous week. A record that is altered or removed from the index surfaces in the next link, within at most seven days, and that finding is itself sealed into the permanent chain.
Administrators can export a signed bundle of every record in the current filter scope: a manifest, a detached signature, each record’s raw stored bytes, and a summary PDF. The signature verifies with standard openssl against PulseAI’s published signing key, and every payload re-hashes with shasum. No PulseAI account, no PulseAI software, no network access.
Bundles are capped at 5,000 records and are never truncated. An over-cap scope fails loudly rather than producing a partial bundle that could pass as a complete one. Each bundle is recorded as a disclosure, with its scope, record count, requester, and artifact hash, and is sealed into the same weekly chain. “What exactly did we give the auditor in March?” now has a verifiable answer.
The four-step procedure is on the Evidence Vault page.
unsealedCount, rather than leaving it to be inferred.PulseAI organizes the evidence and makes its integrity checkable. Whether that evidence satisfies a given obligation remains your organization’s determination, and no third party has attested the Evidence Vault.
If you have connected Claude, ChatGPT, or Copilot to PulseAI through the MCP server, the ledger is there too. Two read-only tools, list_evidence and get_evidence_record, return each record’s metadata and receipt, so an assistant can cite a record in a memo rather than assert that evidence exists. Where an attestation or assessment is described, the assistant is also told whether the vault holds a sealed record of it. By design, the assistant cannot download or verify a payload. Both need the web application, which reads under your organization’s key.
At contract end, erasure is cryptographic: destroying your organization’s key makes every record and every bundle unreadable at once. It is all or nothing, so it can never alter or selectively remove individual records.
The full picture, including retention profiles, roles, and the verification procedure, is on the Evidence Vault page.
At a glance
partnerships@pulseai.now