Live on every vault unlock
For compliance officers, legal teams & risk managers
Prove what your AI consulted. Every time.
When a regulator asks what compliance intelligence your AI agent was acting on, you have an immediate, verifiable answer. Every Bidda vault unlock returns a cryptographic compliance receipt, a permanent, verifiable record of which regulation, which version, and exactly when.
A compliance audit trail is a permanent, verifiable record of which regulation an AI agent consulted, which version, and exactly when.
See Enterprise Plans
Integration Guide
10,102 nodes
·
39 pillars
·
avg 7 citations/node
·
rolling source fingerprinting
·
0 schema violations
The problem
Your AI is making compliance decisions. Can you prove what it consulted?
AI agents are now querying regulatory frameworks, generating compliance opinions, and executing regulated workflows autonomously. Regulators (GDPR supervisory authorities, SEC, FCA, MAS, APRA) are increasingly asking organisations to document the AI decision inputs behind compliance actions. Without a verifiable audit trail, you can't prove your agent consulted the right regulation, the right version, or consulted it at all.
Bidda closes this gap. Every node unlock generates a compliance receipt: a cryptographic record embedded in the API response, tied to an on-chain payment proof, permanently verifiable against the Bidda registry.
The compliance receipt
What you get on every unlock
The _receipt block is appended automatically to every vault response (a single node, or many nodes in one call) and there is nothing to configure.
API response (vault tier)
{
"_receipt": {
"node_id": "gdpr-article-33-breach-notification-to-supervisory-authority",
"version": "2.1.3",
"integrity_hash": "sha256:a3f9c2e1b4d8f7a6c5e3b2d1...",
"accessed_at": "2026-05-01T09:32:14.000Z",
"txid": "0x7a3b8f1c2d4e5f6a9b0c1d2e...",
"amount_usd": "0.01",
"currency": "USDC/Base",
"registry": "Bidda Sovereign Intelligence",
"statement": "Access to gdpr-article-33-breach-notification-to-supervisory-authority v2.1.3 verified
at 2026-05-01T09:32:14.000Z. Integrity hash
sha256:a3f9... recorded at time of access."
}
}
node_id
Which regulation, unique across all nodes
version
Which version, increments on every amendment
integrity_hash
SHA-256 of node content, verifiable against registry at any future point
accessed_at
ISO 8601 UTC timestamp, millisecond precision
txid
On-chain transaction hash, publicly verifiable on Base blockchain explorer
amount_usd
Confirms a real transaction occurred, no synthetic test receipts
statement
Human-readable string, paste directly into audit submissions
Recommended practice
Store the full _receipt object in your compliance audit log alongside the action your agent took. The statement field is pre-formatted for audit submissions. You can paste it directly into regulatory filings, board reports, or incident documentation without further processing.
Regulatory readiness
5 questions regulators ask, answered
node_id + title
What regulation did your AI consult?
+
version
Which version of the regulation?
+
integrity_hash
Was the source authentic and unmodified?
+
accessed_at
When exactly was it consulted?
+
txid
Can you prove the consultation happened?
+
Source integrity
The provenance chain behind every node
The receipt proves what your agent consulted. The source chain proves that what it consulted was authentic, traced from the primary legal instrument through to the API response.
01
Primary source ingestion
Every node is distilled directly from a primary legal instrument, legislation, a NIST publication, or an official regulation, with no secondary sources and no paraphrasing, averaging 7 direct citations per node.
02
Cryptographic signing
A SHA-256 integrity hash is computed from the node content and committed to the registry. Any modification, even a single character, produces a hash mismatch and triggers a validator failure.
03
Weekly source fingerprinting
Every source URL is re-checked on a continuous oldest-first sweep: TLS certificate fingerprint (SPKI hash) and content SHA-256. Detects DNS hijacking, certificate substitution, and silent regulatory content changes. The measured age distribution of fingerprints is published rather than summarised as a fixed interval.
04
Merkle-anchored audit trail
Each source-check run is committed to git. The commit chain is a tamper-evident Merkle structure. The entire history of "what did this regulation say, and when?" is cryptographically preserved.
Public endpoint
GET https://bidda.com/api/v1/registry-health.json
Source integrity status for all 10,102 nodes. Sources are re-checked on a rolling oldest-first sweep; the file itself carries the measured freshness spread and the time of the last completed check.
View live →
Dependency chain
Full compliance chain, fully traceable
Every Bidda node exposes a dependencies[] array linking prerequisite regulations. When your agent follows the chain, consulting GDPR Article 33, then Article 4, then Article 34, each step generates its own receipt. The full audit trail shows the top-level regulation and the complete regulatory reasoning path your agent followed.
// Agent follows GDPR breach chain: each unlock = one receipt
→
gdpr-article-33-breach-notification-to-supervisory-authority// GDPR Art. 33: Breach Notification (72h rule)
↳
gdpr-article-5-data-principles// GDPR Art. 5: Processing principles (prerequisite)
↳
gdpr-article-34-communication-of-breach-to-data-subjects// GDPR Art. 34: Communication to data subject
↳
gdpr-article-30-records-processing// GDPR Art. 30: Records of processing
// Result: 4 receipts, 4 on-chain txids: complete chain provenance
Enterprise attestation
Institutional-grade audit evidence
Enterprise
Available
Multi-node chain attestation
When your agent follows a dependency chain, consulting GDPR Article 33 and its prerequisites, the full chain is attested in a single audit record.
Enterprise
Available
OSCAL export
Export a governed run as an OSCAL assessment-results document, or any full record as an OSCAL control, so Bidda evidence drops straight into GRC and audit tooling that already reads OSCAL.
Coming
Q1 2027
Signed PDF export
Convert any compliance receipt or chain attestation to a signed, print-ready PDF for inclusion in audit submissions, board reports, and regulatory filings.
Coming
Q1 2027
W3C Verifiable Credential
Export compliance receipts as W3C VC-format digital credentials, machine-verifiable and interoperable with enterprise identity and audit platforms.
Coming
Q2 2027
Agent identity verification
Cryptographically bind your AI agent's identity to the compliance receipt, proving what was consulted and which agent consulted it.
Getting started
Using receipts in your audit workflow today
1
Capture the receipt block
Every vault API response includes _receipt at the top level. Extract it before processing the node content.
const { _receipt, ...nodeContent } = await vaultResponse.json();
2
Store it alongside the action
Record the receipt in your audit log next to the compliance action your agent took. The association matters. The receipt proves the specific intelligence behind the decision.
await auditDB.insert({ action_id, receipt: _receipt, agent_id, timestamp: _receipt.accessed_at });
3
Verify on demand
At any future point, verify the receipt by comparing the integrity_hash against the live discovery endpoint. If they match, the content is unchanged. If not, the regulation was amended after the consultation.
const live = await fetch(`https://bidda.com/api/v1/nodes/${_receipt.node_id}.json`);
const { verification } = await live.json();
const isUnchanged = verification.integrity_hash === _receipt.integrity_hash;
4
Include the statement in filings
The statement field is a human-readable audit string. Paste it directly into audit submissions, board reports, or regulatory filings.
// _receipt.statement:
// "Access to gdpr-article-33-breach-notification-to-supervisory-authority v2.1.3 verified at 2026-05-01T09:32:14.000Z.
// Integrity hash sha256:a3f9... recorded at time of access."
7
Avg citations per node
0
Schema violations
0
Broken dep links
Weekly
Source integrity check
Start building your audit trail
Every node unlock is a compliance record.
Start with a free trial.
Start a 7-day free trial, no card needed. Enterprise plans add chain attestation and unlimited unlocks.
Browse 10,102 Nodes
Enterprise Plans
Speak to a Specialist