Prove what your AI agents did.
Sealed daily. Verifiable by anyone, including someone who does not trust Virimo.
Two lines of code send every proposed and executed agent action into a per-System hash chain. Virimo seals that chain every day at 00:10 UTC and publishes the root in public.
One click turns it into a Dossier: a signed PDF and JSON mapped to the clauses an auditor cites. Your customer's security reviewer can check it without an account.
Ledgers are not open yet. This page collects nothing.
This is what the auditor gets to read.
Newest Entry first. Each one seals the hash of the Entry before it, so a single altered or deleted record breaks the chain in a way anyone can see.
| entry | recorded at (utc) | agent | tool | outcome | seals previous | this entry |
|---|---|---|---|---|---|---|
| 4,182 | 2026-08-25T09:41:07Z | payments_agent | refund.create | recorded | 3ab7f10c94de… | 8c41d9e07b62… |
| 4,181 | 2026-08-25T09:40:52Z | payments_agent | ledger.read | recorded | 0d5e8b21fa77… | 3ab7f10c94de… |
| 4,180 | 2026-08-25T09:38:19Z | claims_agent | claim.adjudicate | human approved | b6109cf3e2a8… | 0d5e8b21fa77… |
| 4,179 | 2026-08-25T09:37:44Z | claims_agent | customer.record.read | recorded | 5f2a7d0b81c4… | b6109cf3e2a8… |
| 4,178 | 2026-08-25T09:36:02Z | payments_agent | payout.create | declined | e70c46a19d3b… | 5f2a7d0b81c4… |
| 4,177 | 2026-08-25T09:35:57Z | payments_agent | kyc.check | recorded | 12de9a6f40b7… | e70c46a19d3b… |
| 4,176 | 2026-08-25T09:33:11Z | claims_agent | policy.lookup | recorded | a4b83e07c1d6… | 12de9a6f40b7… |
| 4,175 | 2026-08-25T09:31:08Z | payments_agent | refund.propose | recorded | first entry | a4b83e07c1d6… |
Your agents already touch money, claims and customer records.
Then one question arrives, and it is always the same question. Most firms find out the answer does not exist during an enterprise security review, an internal audit, or a board meeting.
“Show me exactly what the agent did, when, on whose instruction, and prove the record has not been edited.”
Asked once. Answered in days. Remembered for years.
Application logs
Scattered across the observability stack and written for debugging. Anyone with database access can rewrite them.
Not evidence
A governance suite
Intake forms, risk questionnaires and policy packs, priced from five figures. Documents the company wrote about its own AI.
Self-attested
A spreadsheet
Maintained by hand by the compliance lead. Accurate right up to the week nobody had time.
One person’s memory
Meanwhile EU AI Act Article 12, SOC 2 CC7.2, HIPAA §164.312(b), FINRA 4511 and DORA all ask for one thing. A record.
Evidence should be a byproduct of the agent running.
Governance software lost the plot by asking humans to describe their AI. Virimo records behaviour instead. One REST call from any language, and the Entry is sealed at the position it arrived in.
Entry 4,182 seals 4,181, which seals 4,180. The Daily Seal root covers all three.
curl -X POST https://virimo.nanocorp.app/v1/events \
-H "authorization: Bearer sk_live_..." \
-d '{
"system": "payments_agent",
"actor": "agent",
"tool": "refund.create",
"inputs": {"charge": "ch_3Q1x", "amount": 4200},
"outputs": {"refund": "re_1M8k"},
"model": "internal-router-v4",
"outcome": "recorded"
}'
202 Accepted- 01Each Entry seals the one before it.Edit or remove a record and the next hash no longer matches. The break is visible, dated and permanent.
- 02Nothing is editable, ever.There is no update endpoint and no delete endpoint. An Entry has one position and one hash.
- 03Ingest never blocks your Agent.It answers 202 and returns no error a production system could trip over. Read-only earns trust.
A hash already sitting in your inbox cannot be quietly rewritten.
Every day at 00:10 UTC, Virimo computes a Merkle root over all sealed Entries, publishes it on a public page, and emails it to the license holder. The record is witnessed outside our own database.
That is the whole method, and it is not a new one. Certificate Transparency logs work this way: publish the fingerprint, and the past is fixed.
What a seal proves. That these Entries existed at that time and have not changed since. It does not prove your Agent behaved well, and it is not a claim about your compliance status. We issue no badges, about ourselves or about you.
Not a dashboard. A document that survives being doubted.
One click reads the Ledger and produces a signed PDF and a machine-readable JSON, mapped clause by clause onto what the auditor actually cited.
| Clause | What it asks for | What the Dossier carries |
|---|---|---|
| EU AI Act Art. 12 | Automatic recording of events across the system's lifetime | Every Entry with its UTC timestamp, actor, chain position and outcome |
| EU AI Act Annex IV | Technical documentation of the system and its purpose | System registration, model, Agent purpose and the Mapping narrative |
| SOC 2 CC7.2 | Monitoring for anomalies, and acting on what is found | Anomaly summary per Agent, with the Entries behind each one |
| HIPAA §164.312(b) | Audit controls recording activity on records holding ePHI | Entries that touched a customer record, with actor and result |
| FINRA 4511 | Books and records, retained and unaltered | Retention window, the sealed root, and verification instructions |
Every Dossier carries the root it was sealed against and the instructions to check it. That is why the artefact travels: it puts a verification page in front of the exact people who must ask for one.
Public, account-free, and only three possible answers.
An auditor, an enterprise security reviewer or a regulator drops the JSON on the Verify page. Nobody signs in. Nothing is sold to them.
Matches Daily Seal 2026-08-24, root 9f2c1a3d7b04…, checked 2026-08-25T09:22:07Z.
Sample Entries are not sealed publicly, so this file cannot be verified.
This Dossier does not match the published Daily Seal. Both roots are shown.
Virimo is the only AI governance product whose evidence can be checked by someone who does not trust Virimo.
The price is on the page, because a sales call is not a product.
One payment on a card, no subscription. The unit is the System: one registered AI system, licensed for 12 months.
Free
- 1,000 Events
- 14-day retention
- Sample Dossier, watermarked
- Does not pass Verify
System License
the unit- Unlimited Event ingest
- Hash-chained storage
- Daily Seal, emailed and published
- Unlimited Dossier exports
Program License
- Everything in System License
- Three registered Systems
- One renewal date to track
- For firms running several Agents
If a license lapses, new ingest and new exports stop. Entries are never deleted and past Dossiers keep verifying. Evidence you cannot retrieve later is not evidence.
Ledgers are not open yet.
Virimo is being built in the open. Ingest, the Daily Seal, Dossier export and Verify are not live today, so there is nothing here to sign up for and no address being collected.
When the first Ledger opens, a System License is $2,900 for 12 months. The Free tier needs no card. Target time from this page to a Dossier in your hand: 4 minutes.
Keep this address. It is the one the Dossiers will point at.
virimo.nanocorp.app