Prove what your AI consulted.
Every time.
When a regulator asks what compliance intelligence your AI agent was acting on — you answer in 10 seconds. Every Bidda vault unlock returns a cryptographic compliance receipt: a permanent, verifiable record of which regulation, which version, and exactly when.
The problem
Your AI is making compliance decisions. Can you prove what it consulted?
AI agents are now querying regulatory frameworks, generating compliance opinions, and executing regulated workflows autonomously. Regulators — GDPR supervisory authorities, SEC, FCA, MAS, APRA — are increasingly asking organisations to document the AI decision inputs behind compliance actions. Without a verifiable audit trail, you can't prove your agent consulted the right regulation, the right version, or consulted it at all.
Bidda closes this gap. Every node unlock generates a compliance receipt: a cryptographic record embedded in the API response, tied to an on-chain payment proof, permanently verifiable against the Bidda registry.
The compliance receipt
What you get on every unlock
The _receipt block is appended to every vault response — single node, pillar bundle, or multi-pillar bundle. You don't configure it. It's always there.
API response (vault tier)
{
"_receipt": {
"node_id": "eu-gdpr-article-33",
"version": "2.1.3",
"integrity_hash": "sha256:a3f9c2e1b4d8f7a6c5e3b2d1...",
"accessed_at": "2026-05-01T09:32:14.000Z",
"txid": "0x7a3b8f1c2d4e5f6a9b0c1d2e...",
"amount_usd": "0.01",
"currency": "USDC/Base",
"registry": "Bidda Sovereign Intelligence",
"statement": "Access to eu-gdpr-article-33 v2.1.3 verified
at 2026-05-01T09:32:14.000Z. Integrity hash
sha256:a3f9... recorded at time of access."
}
}Recommended practice
Store the full _receipt object in your compliance audit log alongside the action your agent took. The statement field is pre-formatted for audit submissions — you can paste it directly into regulatory filings, board reports, or incident documentation without further processing.
Regulatory readiness
5 questions regulators ask — answered
Source integrity
The provenance chain behind every node
The receipt proves what your agent consulted. The source chain proves that what it consulted was authentic — traced from the primary legal instrument through to the API response.
Primary source ingestion
Every node is distilled from a primary legal instrument — legislation, ISO standard, NIST publication, or official regulation. No secondary sources. No paraphrasing. Average 7 direct citations per node.
Cryptographic signing
A SHA-256 integrity hash is computed from the node content and committed to the registry. Any modification — even a single character — produces a hash mismatch and triggers a validator failure.
Weekly source fingerprinting
Every source URL is checked weekly: TLS certificate fingerprint (SPKI hash) and content SHA-256. Detects DNS hijacking, certificate substitution, and silent regulatory content changes.
Merkle-anchored audit trail
Each weekly source check is committed to git. The commit chain is a tamper-evident Merkle structure — the entire history of "what did this regulation say, and when?" is cryptographically preserved.
Public endpoint
GET https://bidda.com/api/v1/registry-health.json
Updated every Monday 02:00 UTC — source integrity status for all 3,680 nodes
Dependency chain
Full compliance chain, fully traceable
Every Bidda node exposes a dependencies[] array linking prerequisite regulations. When your agent follows the chain — consulting GDPR Article 33, then Article 4, then Article 34 — each step generates its own receipt. The full audit trail shows not just the top-level regulation but the complete regulatory reasoning path your agent followed.
// Agent follows GDPR breach chain — each unlock = one receipt
// Result: 4 receipts, 4 on-chain txids — complete chain provenance
Enterprise attestation
Institutional-grade audit evidence
Multi-node chain attestation
When your agent follows a dependency chain — consulting GDPR Article 33 and its prerequisites — the full chain is attested in a single audit record.
Signed PDF export
Convert any compliance receipt or chain attestation to a signed, print-ready PDF for inclusion in audit submissions, board reports, and regulatory filings.
W3C Verifiable Credential
Export compliance receipts as W3C VC-format digital credentials — machine-verifiable, interoperable with enterprise identity and audit platforms.
Agent identity verification
Cryptographically bind your AI agent's identity to the compliance receipt — proving not just what was consulted, but which agent consulted it.
Getting started
Using receipts in your audit workflow today
Capture the receipt block
Every vault API response includes _receipt at the top level. Extract it before processing the node content.
const { _receipt, ...nodeContent } = await vaultResponse.json();Store it alongside the action
Record the receipt in your audit log next to the compliance action your agent took. The association matters — the receipt proves the specific intelligence behind the decision.
await auditDB.insert({ action_id, receipt: _receipt, agent_id, timestamp: _receipt.accessed_at });Verify on demand
At any future point, verify the receipt by comparing the integrity_hash against the live discovery endpoint. If they match — the content is unchanged. If not — the regulation was amended after the consultation.
const live = await fetch(`https://bidda.com/api/v1/nodes/${_receipt.node_id}.json`);
const { verification } = await live.json();
const isUnchanged = verification.integrity_hash === _receipt.integrity_hash;Include the statement in filings
The statement field is a human-readable, court-ready string. Paste it directly into audit submissions, board reports, or regulatory filings.
// _receipt.statement: // "Access to eu-gdpr-article-33 v2.1.3 verified at 2026-05-01T09:32:14.000Z. // Integrity hash sha256:a3f9... recorded at time of access."
7
Avg citations per node
0
Schema violations
0
Broken dep links
Weekly
Source integrity check
Start building your audit trail
Every node unlock is a compliance record.
Start at $0.01.
Pay-as-you-go is live now — no account, no subscription. Enterprise plans add chain attestation, signed PDF export, and unlimited unlocks.