AttestorianFrequently asked questions.
Straight answers to the questions risk, security, and engineering teams ask most.
Product
What is Attestorian, in one sentence?
Attestorian is a flight recorder and safety switch for AI agents: it stops out-of-policy actions before they run, seals every action into tamper-evident evidence signed with customer KMS or HSM keys, hides sensitive data on demand, and lets anyone verify the record offline.
Is Attestorian specific to one industry?
No. It governs AI agent actions in any domain. Our banking case study shows the pattern in one of the most demanding environments.
Which AI models and agent frameworks does Attestorian support?
Attestorian is completely model-agnostic and framework-agnostic. It governs and records agent actions and tool calls via Python and TypeScript SDKs, an inline Model Context Protocol (MCP) tool gateway, or an OpenTelemetry bridge, regardless of which LLM provider powers the agent.
Does Attestorian prove an AI answer is factually correct?
No. Attestorian proves exactly what inputs, policy checks, approvals, and tool calls occurred and guarantees cryptographically that the record has not been altered. Evaluating whether a model's substantive reasoning was correct remains a matter for human judgment and model validation.
Is it a replacement for our logging or observability tools?
No. It complements them by adding tamper-evidence, pre-execution control, privacy-preserving sharing, and independent verification, which those tools were not designed to provide.
Data and security
Does Attestorian need access to our production data?
No. Pilots run on synthetic or anonymized data in staging. In production, Attestorian runs inside your environment, and evidence never needs to leave it for verification.
Who owns the signing keys and the evidence packages?
The enterprise organization accountable to its regulators and customers owns both the evidence packages and the signing keys. Evidence is signed using keys held inside your own KMS or HSM, and verification never requires transmitting data back to Attestorian.
What cryptography does it use?
The production core uses industry-standard, publicly reviewed signature and hashing algorithms through established cryptographic libraries. It does not rely on home-grown cryptography, and research components are disabled in production builds.
Has Attestorian had an independent security review?
Not yet. An independent third-party review is planned, and we welcome a review commissioned or nominated by a partner. Our trust center shows current maturity in full.
Integration and operations
Do we have to change our core systems?
No. Attestorian integrates at the AI agent, orchestration, and API layers through SDKs, an inline tool gateway, or read-only ingestion of existing traces.
Will Attestorian slow down our production AI agents?
No. The inline guard gateway is engineered for low-latency tool paths, adding a median overhead of under 0.3 ms per tool call in local benchmarks (with a formal pilot acceptance target of 5 ms or less), or 0 ms on the live path when deployed in asynchronous Shadow mode.
Can it run in a private cloud or on-premise?
Yes. Sovereign and private deployments run entirely inside your environment with local key custody.
Can different business units or countries have different rules?
Yes. Policies, approval rules, retention, and redaction profiles are configurable per tenant and jurisdiction.
Commercial
How do organizations evaluate and start with Attestorian?
Evaluation begins with a live technical demonstration on an offline laptop, followed by a 30-day controlled pilot on one AI workflow in your staging or VPC environment. The USD 10,000 pilot fee is credited in full toward your first annual subscription year.
What happens to our evidence if we stop using Attestorian?
It remains verifiable with the free offline verifiers indefinitely. There is no lock-in on historical evidence.
Is this legal or compliance advice?
No. Attestorian provides technical evidence and controls that support compliance programmes. Each organization remains responsible for its own regulatory interpretation.
Have more technical questions?
Book a technical session with our systems engineers, or test offline verification yourself. The USD 10,000 pilot fee is credited in full.
Last updated: