Growth
$25k per year
For your first regulated AI system
- Up to 5 registered AI systems
- 1M sealed events / month included
- EU AI Act, ISO 42001, NIST AI RMF, SOC 2 packets
- SSO (OIDC), console, signed attestations
AI governance evidence ledger
Evidence your AI can’t un‑write.
Provara seals every AI decision into a tamper‑evident ledger, witnesses it nightly into write‑once storage, and turns it into signed evidence packets your auditors can verify — without trusting anyone, including us.
Built for the EU AI Act’s August 2026 high‑risk obligations · ISO/IEC 42001 · NIST AI RMF · SOC 2
EVIDENCE LEDGER · LIVE184,223 records sealed
- 11:59:07support-copilothuman.overrideEU_AI_ACT.ART14SEALED
- 11:59:09claims-triage-llmmonitor.driftNIST.MEASURE-2.7SEALED
- 11:59:10claims-triage-llmmodel.outputEU_AI_ACT.ART12SEALED
- 11:59:12support-copilotmodel.invocationEU_AI_ACT.ART12SEALED
- 11:59:14support-copilothuman.overrideEU_AI_ACT.ART14SEALED
- 11:59:16support-copilothuman.overrideEU_AI_ACT.ART14SEALED
- 11:59:17support-copilothuman.overrideEU_AI_ACT.ART14SEALED
CHAIN VERIFIEDexternally witnessed nightly · write-once storage · 7-year retention
“Show us every decision your AI made about this person — and prove the records weren’t edited afterwards.”
A flight recorder for your AI
Four steps, fully automatic. Your engineers change two lines of code; your compliance team changes nothing.
- CAPTURE
A two-line SDK records every AI event — model calls, outputs, human overrides. Metadata only: your prompts and customer data never leave your systems.
- SEAL
Each record is cryptographically chained to the one before it, like numbered pages in a sealed notebook. Edits don't get hidden — they get exposed.
- ANCHOR
Every night the chain is re-verified and witnessed into write-once storage that nobody — including Provara — can alter for seven years.
- PROVE
One click exports a signed evidence packet, pre-mapped to the regulation it satisfies and verifiable against our published key.
from provara_sdk import Provara
async with provara.record("claims-triage-llm", "model.invocation"):
result = await llm(...) # that's the integrationBuilt to pass your security review
The architecture answers the questionnaire before you send it.
Single sign-on only
Your IdP, your groups, your roles — OIDC or SAML 2.0. No Provara passwords exist anywhere.
Isolation enforced by the database
Row-level security keyed to your verified identity. A cross-tenant read returns zero rows even if application code has a bug.
Write-only application keys
Your AI systems authenticate with 24-hour keys that can append events and do nothing else. A leaked key reads nothing.
We can't touch your history either
Ledger writes are append-only at the database layer; nightly seals live in 7-year write-once storage under compliance lock.
Your keys, your region
Encryption at rest on dedicated keys with BYOK, TLS 1.3 only, and single-tenant private deployment for regulated workloads.
Verifiable without trusting us
Evidence packets carry an RS256 signature anyone can check against our published public key. The seal is the proof.
SOC 2 Type II observation in progress · independent penetration test scheduled · evidence for both produced by Provara itself — we are our own first tenant.
Pricing
Annual contracts. Volume grows with your AI footprint; the meter is the ledger itself — unimpeachable by construction.
Enterprise
$60k per year
For AI portfolios under audit
- Up to 25 registered AI systems
- 10M sealed events / month included
- Single-tenant private deployment (VPC)
- SAML 2.0, BYOK encryption keys
- Security-review fast lane (questionnaires in days)
Regulated
Custom annual contract
For systemically supervised institutions
- Unlimited AI systems, custom event volume
- Dedicated cluster, custom data region & retention
- Auditor portal seats and supervised disputes process
- Named support with incident SLAs
Questions risk teams ask first
Does Provara see our prompts or customer data?
No. The SDK ships metadata — event type, timestamps, system identifiers, redaction statistics. What your AI said and what your customers said stays inside your systems. This is structural, not a policy: the payload your engineers send is the payload we seal.
We already have a governance platform. Why add Provara?
Keep it. Governance platforms document policies, workflows, and attestations. Provara is the sealed system of record those attestations point to — the layer that turns “we assert” into “we can prove.” They get stronger together.
How is this different from our logging stack?
Ordinary logs can be edited by admins or applications, which gives them weak evidentiary value. Provara records are append-only, cryptographically chained, and externally witnessed nightly into write-once storage — alterations don't get hidden, they get exposed.
What does an auditor actually receive?
A signed evidence packet (PDF or machine-readable) summarizing sealed records per regulatory control, with the witness date and a signature verifiable against our published public key. No raw internals, no spreadsheet archaeology.
How long does deployment take?
One AI system is typically sealing events the same day: connect SSO, mint a write-only application key, add two lines of code. Evidence accrues from the first hour — and it can't be backfilled later, which is why teams start before their audit, not during it.
What happens if Provara is unreachable?
Your AI keeps working. The SDK queues events locally and replays them losslessly when connectivity returns. For genuinely high-risk decision paths there's a strict mode that refuses to proceed until the event is sealed — your lawyers may want exactly that.
Start the clock before the regulators do
Tell us about one AI system in a regulated workflow. We’ll show you, on your use case, what sealed evidence looks like — and what your first audit export would contain.
- 30 minutes, technical, no slideware
- Security questionnaire turnaround in days, not weeks
- First system typically sealing the same day