Cryptographic Compliance Tools
Generate, verify, and audit cryptographic evidence for AI-generated content. Interactive demos of TRAI's technical capabilities.
Generate & Verify
Generate and verify cryptographic compliance certificates for AI-generated content. Demonstrates TRAI's signing, timestamping, and SCITT receipt/inclusion-proof workflow. Live anchoring requires buyer operation.
Integration Examples
CLI
# Sign AI-generated content
trai sign \
--content "Your AI output here" \
--system-id "my-ai-agent" \
--org-id "acme-corp"
# Verify a certificate
trai verify \
--cert-id "tl_9f8a2b1d5f3e9c7a" Python SDK
from trai import TRAIClient
client = TRAIClient(
api_url="https://your-domain",
api_key="your-api-key"
)
# Generate certificate
cert = client.notarize(
content="AI-generated text here",
content_type="text",
ai_system_id="my-agent"
)
print(f"Certificate: {cert.certificate_id}")
print(f"Verify URL: {cert.verify_url}") TypeScript SDK
import { TRAIClient } from '@trai/sdk';
const client = new TRAIClient({
apiUrl: 'https://your-domain',
apiKey: 'your-api-key'
});
// Generate certificate
const cert = await client.notarize({
content: 'AI-generated text here',
contentType: 'text',
aiSystemId: 'my-agent'
});
console.log(`Certificate: ${cert.certificateId}`);
console.log(`Verify URL: ${cert.verifyUrl}`); REST API
# Sign content
curl -X POST https://your-domain/v1/notarize \
-H "Authorization: Bearer $TRAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"content_hash": "sha256:abc123...",
"content_type": "text",
"ai_system_id": "my-agent"
}'
# Verify certificate
curl https://your-domain/v1/verify/tl_9f8a2b1d \
-H "Authorization: Bearer $TRAI_API_KEY" This tool operates in Demo / Simulation mode. Cryptographic operations are performed locally in your browser. No data is transmitted to external services during demo mode. For production use, deploy your own TRAI instance.
Sample Certificate
Visually rich certificate card showing TRAI's compliance evidence output. Each certificate includes cryptographic proof, SCITT anchoring, and eIDAS timestamp.
Cryptographic Evidence Record
TRAI — Illustrative Sample
Agent Console
Monitor and manage AI agent compliance status. Filter by risk tier and compliance status.
| Agent Name | System ID | Risk Tier | Status | Trust Score | Actions |
|---|---|---|---|---|---|
| chatbot-prod-v2 | cs-2024-117 | limited | compliant | 94% | |
| doc-summarizer | doc-2024-031 | minimal | compliant | 91% | |
| code-reviewer-v3 | eng-2024-088 | limited | compliant | 89% | |
| translation-bot | i18n-2024-014 | minimal | compliant | 93% | |
| fraud-detector | risk-2024-201 | high | compliant | 96% | |
| hr-screener-v1 | hr-2024-007 | high | gaps | 78% | |
| contract-reviewer | legal-2024-042 | limited | pending | 73% | |
| travel-planner | ops-2024-156 | minimal | compliant | 87% |
Trust Crosswalk
Framework compliance mapping across EU regulations, cryptographic standards, and trust programs. Each entry shows TRAI's coverage status and honest gap disclosure.
EU Regulations
Transparency obligations for AI-generated content. Mandatory labeling, machine-readable detection, watermark where technically feasible. Enforcement Aug 2, 2026; grandfathering to Dec 2, 2026 (Digital Omnibus May 2026).
- COSE_Sign1 hybrid Ed25519 + ML-DSA-65 cryptographic provenance per AI output
- C2PA-compatible assertion embedding (optional)
- Kirchenbauer watermark for text outputs (defense in depth)
- EU Trust List validation of QTSP issuers (Actalis Italia)
- PLD-compliant disclosure + defect rebuttal (see /v1/pld/* endpoints)
Self-assessed technical mapping. No third-party certification. EU Trust List hardcoded (3 SHA-1 fingerprints) rather than fetching LOTL dynamically.
Software and AI systems qualify as "products" — strict liability for defects including security-update failures. Transposition deadline Dec 9, 2026. TRAI helps the defendant rebut the Art. 10 defect / causation presumptions via cryptographic evidence.
- Helps the defendant rebut PLD Art. 10 defect / causation presumptions (PLD puts the burden on the plaintiff; TRAI gives the defendant a cryptographic evidence pack)
- Immutable SCITT ledger (RFC 9943) of every cert issuance = audit trail for defect defense
- BLAKE3 hash chain (P4.6 encapsulation) — tamper-evident history
- Evidence bundle PDFs with full cryptographic chain (issuer + signature + timestamp + receipt)
- Defect rebuttal endpoint /v1/pld/rebuttal — produces evidence pack
Self-assessed technical mapping. /v1/pld/rebuttal endpoint returns cose_sign1_b64=None (stub — does not sign the rebuttal payload). No third-party PLD certification.
Encryption at rest, in transit, and in use. Cryptographic key lifecycle. Crypto-agility (swap algorithms). Active supervision 2026.
- Hybrid Ed25519 + ML-DSA-65 = crypto-agile composite (IETF draft-ietf-lamps-pq-composite-sigs-15)
- ML-DSA-65 keys in FIPS 140-3 Level 3 HSM (AWS KMS, GCP KMS) — encryption at rest
- TLS 1.3 with hybrid PQ/T default (Cloudflare Pages + Render) — encryption in transit
- Algorithm swap via composition without breaking compatibility
Self-assessed dynamic assessment via /v1/dora/evidence-pack (per-check status: Covered / NotYetEvidenced). No formal DORA certification.
Policies and procedures regarding cryptography and, where appropriate, encryption. Proportionate to risk.
- Documented cryptography policy: SHA-256 + BLAKE3 hashing, Ed25519 + ML-DSA-65 signing, AES-GCM for envelope encryption
- Algorithm registry in /docs/SECURITY.md (post-refactor D6 canonical)
- Crypto-agility roadmap in /docs/ARCHITECTURE.md
Self-assessed technical mapping. No NIS2 certification body involvement.
ISO/IEC 42001 — AI Management System
Annex A controls (38 mapped via themis-compliance mapper). Certification target Q2 2028.
- Annex A control mapping via crates/themis-compliance/src/iso_42001.rs
- Statement of Applicability endpoint /v1/iso42001/soa
- Automated control status dashboard in /console
Independent third-party audit scheduled Q2 2028.
Cryptographic Standards
FIPS 204 ML-DSA-65 finalized Aug 14, 2024. Hybrid Ed25519 + ML-DSA-65 composite per IETF drafts. Key custody in FIPS 140-3 Level 3 HSM.
- ML-DSA-65 keys in AWS KMS eu-central-1 (FIPS 140-3 Level 3 validated HSM)
- Composite signatures per draft-ietf-lamps-pq-composite-sigs-15 (PKIX) + draft-ietf-jose-pq-composite-sigs-01 (COSE)
- Ed25519 fallback for legacy interop
ML-DSA-65 implemented and CVEs patched. HSM signing at prod volume (>=100 req/s) not load-tested. AWS KMS throttling at p99 unknown.
Standards Track (June 2026). Receipts are COSE_Sign1 envelopes with Merkle inclusion proof. CCF 7.x ledger implementation.
- /receipt/cose endpoint on CCF 7.x ledger
- COSE_Sign1 receipt envelope (RFC 9052) with Merkle proof
- COSE-only ledger signing mode (CCF 7.0.0 feature)
- Auditable inclusion in transparency log
Implemented and tested. SCITT is pre-ratification; CCF ledger is dev-mode only in demo. Production deployment requires real SCITT + QTSP configuration.
Standards Track (Nov 2025). W3C VC 2.0 + EUDI Wallet ready. Selective disclosure via zero-knowledge proofs.
- SD-JWT VC envelopes for cert claims
- Selective disclosure of issuer, signature algorithm, timestamp without revealing payload
- EUDI Wallet integration (ARF v1.4 compatible)
Deferred. Orthogonal to current SCITT + COSE_Sign1 stack; estimated ~4 weeks of work. No current product requirement.
Trust Programs
Self-assessment complete. Silver submission pending per .bestpractices.json. Badge metadata update requires maintainer login. Gold target Q4 2026.
- All Silver criteria met (license, contribution, docs, security, testing)
- Branch protection: 10 required CI checks (cargo-deny, cargo-audit, clippy, rustfmt, 3×OS rust test, ruff, pytest, pip-audit, Analyze)
- F1-F15 acceptance gate green (refactor F1-F15 PASS 2026-07-04)
- SLSA L3 build provenance in progress
Gold criteria incremental: dangerous-workflow + token_permissions + signed releases.