LIVE ON EVERY VAULT UNLOCK
FOR COMPLIANCE OFFICERS, LEGAL TEAMS & RISK MANAGERS
Prove what your AI consulted.
Every time.
When a regulator asks what compliance intelligence your AI agent was acting on, you answer in 10 seconds. Every Bidda vault unlock returns a cryptographic compliance receipt: a permanent, verifiable record of which regulation, which version, and exactly when.
SEE ENTERPRISE PLANS
INTEGRATION GUIDE
10,108 NODES
·
39 PILLARS
·
AVG 7 CITATIONS/NODE
·
WEEKLY SOURCE FINGERPRINTING
·
0 SCHEMA VIOLATIONS
THE PROBLEM
Your AI is making compliance decisions. Can you prove what it consulted?
AI agents are now querying regulatory frameworks, generating compliance opinions, and executing regulated workflows autonomously. Regulators (GDPR supervisory authorities, SEC, FCA, MAS, APRA) are increasingly asking organisations to document the AI decision inputs behind compliance actions. Without a verifiable audit trail, you can't prove your agent consulted the right regulation, the right version, or consulted it at all.
Bidda closes this gap. Every node unlock generates a compliance receipt: a cryptographic record embedded in the API response, tied to an on-chain payment proof, permanently verifiable against the Bidda registry.
THE COMPLIANCE RECEIPT
What you get on every unlock
The _receipt block is appended to every vault response: single node, pillar bundle, or multi-pillar bundle. You don't configure it. It's always there.
API RESPONSE (VAULT TIER)
{
"_receipt": {
"node_id": "eu-gdpr-article-33",
"version": "2.1.3",
"integrity_hash": "sha256:a3f9c2e1b4d8f7a6c5e3b2d1...",
"accessed_at": "2026-05-01T09:32:14.000Z",
"txid": "0x7a3b8f1c2d4e5f6a9b0c1d2e...",
"amount_usd": "0.01",
"currency": "USDC/Base",
"registry": "Bidda Sovereign Intelligence",
"statement": "Access to eu-gdpr-article-33 v2.1.3 verified
at 2026-05-01T09:32:14.000Z. Integrity hash
sha256:a3f9... recorded at time of access."
}
}
node_id
Which regulation, unique across all nodes
version
Which version, increments on every amendment
integrity_hash
SHA-256 of node content, verifiable against registry at any future point
accessed_at
ISO 8601 UTC timestamp, millisecond precision
txid
On-chain transaction hash, publicly verifiable on Base blockchain explorer
amount_usd
Confirms a real transaction occurred, no synthetic test receipts
statement
Human-readable string, paste directly into audit submissions
RECOMMENDED PRACTICE
Store the full _receipt object in your compliance audit log alongside the action your agent took. The statement field is pre-formatted for audit submissions. You can paste it directly into regulatory filings, board reports, or incident documentation without further processing.
REGULATORY READINESS
5 questions regulators ask, answered
NODE_ID + TITLE
What regulation did your AI consult?
+
VERSION
Which version of the regulation?
+
INTEGRITY_HASH
Was the source authentic and unmodified?
+
ACCESSED_AT
When exactly was it consulted?
+
TXID
Can you prove the consultation happened?
+
SOURCE INTEGRITY
The provenance chain behind every node
The receipt proves what your agent consulted. The source chain proves that what it consulted was authentic, traced from the primary legal instrument through to the API response.
01
Primary source ingestion
Every node is distilled from a primary legal instrument: legislation, ISO standard, NIST publication, or official regulation. No secondary sources. No paraphrasing. Average 7 direct citations per node.
02
Cryptographic signing
A SHA-256 integrity hash is computed from the node content and committed to the registry. Any modification, even a single character, produces a hash mismatch and triggers a validator failure.
03
Weekly source fingerprinting
Every source URL is checked weekly: TLS certificate fingerprint (SPKI hash) and content SHA-256. Detects DNS hijacking, certificate substitution, and silent regulatory content changes.
04
Merkle-anchored audit trail
Each weekly source check is committed to git. The commit chain is a tamper-evident Merkle structure. The entire history of "what did this regulation say, and when?" is cryptographically preserved.
PUBLIC ENDPOINT
GET https://bidda.com/api/v1/registry-health.json
Updated every Monday 02:00 UTC. Source integrity status for all 10,108 nodes.
VIEW LIVE →
DEPENDENCY CHAIN
Full compliance chain, fully traceable
Every Bidda node exposes a dependencies[] array linking prerequisite regulations. When your agent follows the chain, consulting GDPR Article 33, then Article 4, then Article 34, each step generates its own receipt. The full audit trail shows not just the top-level regulation but the complete regulatory reasoning path your agent followed.
// Agent follows GDPR breach chain: each unlock = one receipt
→
eu-gdpr-article-33// GDPR Art. 33: Breach Notification (72h rule)
↳
eu-gdpr-article-4-definitions// GDPR Art. 4: Definitions (prerequisite)
↳
eu-gdpr-article-34// GDPR Art. 34: Communication to data subject
↳
edpb-guidelines-breach-notification// EDPB Guidelines 9/2022
// Result: 4 receipts, 4 on-chain txids: complete chain provenance
ENTERPRISE ATTESTATION
Institutional-grade audit evidence
ENTERPRISE
Available
Multi-node chain attestation
When your agent follows a dependency chain, consulting GDPR Article 33 and its prerequisites, the full chain is attested in a single audit record.
COMING
Q3 2026
Signed PDF export
Convert any compliance receipt or chain attestation to a signed, print-ready PDF for inclusion in audit submissions, board reports, and regulatory filings.
COMING
Q3 2026
W3C Verifiable Credential
Export compliance receipts as W3C VC-format digital credentials, machine-verifiable and interoperable with enterprise identity and audit platforms.
COMING
Q4 2026
Agent identity verification
Cryptographically bind your AI agent's identity to the compliance receipt, proving not just what was consulted, but which agent consulted it.
GETTING STARTED
Using receipts in your audit workflow today
1
Capture the receipt block
Every vault API response includes _receipt at the top level. Extract it before processing the node content.
const { _receipt, ...nodeContent } = await vaultResponse.json();
2
Store it alongside the action
Record the receipt in your audit log next to the compliance action your agent took. The association matters. The receipt proves the specific intelligence behind the decision.
await auditDB.insert({ action_id, receipt: _receipt, agent_id, timestamp: _receipt.accessed_at });
3
Verify on demand
At any future point, verify the receipt by comparing the integrity_hash against the live discovery endpoint. If they match, the content is unchanged. If not, the regulation was amended after the consultation.
const live = await fetch(`https://bidda.com/api/v1/nodes/${_receipt.node_id}.json`);
const { verification } = await live.json();
const isUnchanged = verification.integrity_hash === _receipt.integrity_hash;
4
Include the statement in filings
The statement field is a human-readable audit string. Paste it directly into audit submissions, board reports, or regulatory filings.
// _receipt.statement:
// "Access to eu-gdpr-article-33 v2.1.3 verified at 2026-05-01T09:32:14.000Z.
// Integrity hash sha256:a3f9... recorded at time of access."
7
AVG CITATIONS PER NODE
0
SCHEMA VIOLATIONS
0
BROKEN DEP LINKS
Weekly
SOURCE INTEGRITY CHECK
START BUILDING YOUR AUDIT TRAIL
Every node unlock is a compliance record.
Start at $0.01.
Pay-as-you-go is live now. No account, no subscription. Enterprise plans add chain attestation, signed PDF export, and unlimited unlocks.
BROWSE 10,108 NODES
ENTERPRISE PLANS
SPEAK TO A SPECIALIST