Evidence infrastructure for autonomous systems
Make every AI agent action provable.
Durable evidence of who acted, under what authority and when — with independent proof the record still matches what was created.
For timestamping and hash-based sealing, content stays in your systems and Sigill receives only digests and metadata.
Putting consequential agent actions into production? Become a design partner
RFC 3161 · sealed at execution · unaltered
The problem
AI agents now approve claims, move money and ship code. When one of those actions is disputed, an internal log cannot independently prove what happened.
It lives in the same system that produced it, it can be edited after the fact, and it carries no independent proof of who acted, under what authority, or when.
How it works
Use the APIs that exist today. Hash, timestamp, seal, verify.
Sigill exposes focused endpoints for the trust mechanisms: RFC 3161 timestamping, PAdES/CAdES/JAdES sealing, and verification. You choose the right surface for the record you need to prove.
Hash locally
For timestamps and hash-based seals, compute the digest in your system. The payload body does not need to leave your environment.
Anchor or seal
Create an independent timestamp, attach a detached CAdES or JAdES seal, or produce a sealed document using the trust surface that fits the record.
Verify independently
Recipients can verify the timestamp, seal, and document integrity with open standards and ordinary validation tooling.
Timestamp a document or system event
POST /tsa/stamp-hash
hashHex sha512:b2...f0
label agent-output-2847
tsaSlug auto
→ RFC 3161 timestamp tokenSeal a digest — CAdES or JAdES
POST /seal/sign-hash
hashHex sha256:b2...f0
certificateId org-cert-01
format cades | jades
→ detached CAdES or JAdES seal
PDFs: delegated PAdES via the SDKVerify — without trusting Sigill
openssl ts -verify -in evidence.tsr \
-digest b2...f0 -CAfile tsa.pem
→ Verification: OK
no Sigill requiredWhat we prove, precisely
Sigill independently proves that the presented bytes or digest match the evidence created at the time, and that the timestamp or seal validates. It does not prove that the originating application supplied complete or truthful context.
What gets recorded
The actions someone will eventually ask about.
For AI platform teams, Heads of AI, CTOs, CISOs and risk owners responsible for autonomous systems in production.
Approved a EUR 48,200 insurance claim
A payout was authorised autonomously. Months later the decision is disputed, and someone has to show the basis and timing.
Released a EUR 120k supplier payment
Money moved on the agent's authority. Finance needs to prove who sanctioned it, and that the figure was not changed after.
Merged and shipped to production
A change reached customers with no human in the loop. An incident review needs an untampered trail of what ran.
Cleared a customer through onboarding
An identity decision was automated. A regulator later asks for the evidence behind it, and when it was made.
Regulatory fit
The frameworks tell you to keep the records. They leave you to prove the records are trustworthy.
The EU AI Act, DORA and ISO/IEC 42001 all assume that retained records can later withstand scrutiny. What they do not specify is how you demonstrate, months later, that a record still matches what was created. Seal the evidence at execution, and its integrity and time no longer depend solely on the system that stored it.
eu-ai-act · art 12 & 19
Retain high-risk AI logs — with verifiable integrity
The Act requires logs to support traceability and requires providers to retain them. Retention alone does not independently demonstrate that a presented log is unchanged. A timestamp and seal at creation make that independently verifiable throughout the retention period.
dora · art 17, supported by art 9
Verify incident timelines independently
Every ICT incident must be recorded, classified and investigated to identify its root cause. When the timeline itself is questioned, incident records sealed as they are created verify with standard tooling — outside the infrastructure under review.
iso/iec 42001 · 7.5.3
Hand auditors evidence, not exports
The standard requires documented information protected from loss of integrity. Sealed records let an auditor verify integrity and time themselves — instead of relying on screenshots or internal storage controls. The proof remains verifiable outside the originating system.
What this covers, precisely. Sigill supports these controls with independently verifiable evidence of integrity and time. It does not provide compliance on its own.
Similar evidence-integrity needs appear across NIS2, 21 CFR Part 11 and other regulatory and assurance frameworks.
Working with another regulatory framework? Talk to us →
Technical foundation
Open cryptographic standards. A portable evidence layer.
The mechanisms beneath Sigill are standard, well-understood primitives — not a black box you take on faith.
External, independent timestamps from RFC 3161 timestamp authorities. Qualified timestamping is available where your account and policy are entitled.
Advanced electronic seals over documents and digests using PAdES for PDFs, and CAdES or JAdES for detached signatures (JAdES for JSON).
Use your own organisational certificate for customer-issued records, or Sigill's platform certificate for Sigill-issued artefacts.
Verify with OpenSSL, Adobe Acrobat, EU DSS and standard validation tooling — not just Sigill.
Built in Norway and hosted in Europe for teams that need jurisdictional clarity.
Qualified electronic seals are on the roadmap. Today Sigill provides advanced electronic seals and does not claim to issue QESeals.
Governance describes the control environment. Sigill makes individual agent actions independently verifiable.
The evidence layer beneath your governance, observability and control stack — not a replacement for it.Get started
Start producing evidence today.
Create an account and get an API key in minutes — or partner with us on consequential agent actions.
Self-serve
Get started
Create an account, get an API key, and start anchoring evidence with independent timestamps and electronic seals.
Design partner
Become a design partner
For teams putting consequential agent actions into production. We will harden agent evidence with you — in production, with your stack.
EU-hosted · independent evidence layer · hash-first APIs