Bidda Audit Trail & Cryptographic Receipts ========================================== JS-free text mirror for AI crawlers. Canonical page: https://bidda.com/audit Last updated: 2026-07-11 LIVE ON EVERY VAULT UNLOCK FOR COMPLIANCE OFFICERS, LEGAL TEAMS & RISK MANAGERS Prove what your AI consulted. Every time. When a regulator asks what compliance intelligence your AI agent was acting on, you answer in 10 seconds. Every Bidda vault unlock returns a cryptographic compliance receipt: a permanent, verifiable record of which regulation, which version, and exactly when. SEE ENTERPRISE PLANS INTEGRATION GUIDE 10,108 NODES · 39 PILLARS · AVG 7 CITATIONS/NODE · WEEKLY SOURCE FINGERPRINTING · 0 SCHEMA VIOLATIONS THE PROBLEM Your AI is making compliance decisions. Can you prove what it consulted? AI agents are now querying regulatory frameworks, generating compliance opinions, and executing regulated workflows autonomously. Regulators (GDPR supervisory authorities, SEC, FCA, MAS, APRA) are increasingly asking organisations to document the AI decision inputs behind compliance actions. Without a verifiable audit trail, you can't prove your agent consulted the right regulation, the right version, or consulted it at all. Bidda closes this gap. Every node unlock generates a compliance receipt: a cryptographic record embedded in the API response, tied to an on-chain payment proof, permanently verifiable against the Bidda registry. THE COMPLIANCE RECEIPT What you get on every unlock The _receipt block is appended to every vault response: single node, pillar bundle, or multi-pillar bundle. You don't configure it. It's always there. API RESPONSE (VAULT TIER) { "_receipt": { "node_id": "eu-gdpr-article-33", "version": "2.1.3", "integrity_hash": "sha256:a3f9c2e1b4d8f7a6c5e3b2d1...", "accessed_at": "2026-05-01T09:32:14.000Z", "txid": "0x7a3b8f1c2d4e5f6a9b0c1d2e...", "amount_usd": "0.01", "currency": "USDC/Base", "registry": "Bidda Sovereign Intelligence", "statement": "Access to eu-gdpr-article-33 v2.1.3 verified at 2026-05-01T09:32:14.000Z. Integrity hash sha256:a3f9... recorded at time of access." } } node_id Which regulation, unique across all nodes version Which version, increments on every amendment integrity_hash SHA-256 of node content, verifiable against registry at any future point accessed_at ISO 8601 UTC timestamp, millisecond precision txid On-chain transaction hash, publicly verifiable on Base blockchain explorer amount_usd Confirms a real transaction occurred, no synthetic test receipts statement Human-readable string, paste directly into audit submissions RECOMMENDED PRACTICE Store the full _receipt object in your compliance audit log alongside the action your agent took. The statement field is pre-formatted for audit submissions. You can paste it directly into regulatory filings, board reports, or incident documentation without further processing. REGULATORY READINESS 5 questions regulators ask, answered NODE_ID + TITLE What regulation did your AI consult? + VERSION Which version of the regulation? + INTEGRITY_HASH Was the source authentic and unmodified? + ACCESSED_AT When exactly was it consulted? + TXID Can you prove the consultation happened? + SOURCE INTEGRITY The provenance chain behind every node The receipt proves what your agent consulted. The source chain proves that what it consulted was authentic, traced from the primary legal instrument through to the API response. 01 Primary source ingestion Every node is distilled from a primary legal instrument: legislation, ISO standard, NIST publication, or official regulation. No secondary sources. No paraphrasing. Average 7 direct citations per node. 02 Cryptographic signing A SHA-256 integrity hash is computed from the node content and committed to the registry. Any modification, even a single character, produces a hash mismatch and triggers a validator failure. 03 Weekly source fingerprinting Every source URL is checked weekly: TLS certificate fingerprint (SPKI hash) and content SHA-256. Detects DNS hijacking, certificate substitution, and silent regulatory content changes. 04 Merkle-anchored audit trail Each weekly source check is committed to git. The commit chain is a tamper-evident Merkle structure. The entire history of "what did this regulation say, and when?" is cryptographically preserved. PUBLIC ENDPOINT GET https://bidda.com/api/v1/registry-health.json Updated every Monday 02:00 UTC. Source integrity status for all 10,108 nodes. VIEW LIVE → DEPENDENCY CHAIN Full compliance chain, fully traceable Every Bidda node exposes a dependencies[] array linking prerequisite regulations. When your agent follows the chain, consulting GDPR Article 33, then Article 4, then Article 34, each step generates its own receipt. The full audit trail shows not just the top-level regulation but the complete regulatory reasoning path your agent followed. // Agent follows GDPR breach chain: each unlock = one receipt → eu-gdpr-article-33// GDPR Art. 33: Breach Notification (72h rule) ↳ eu-gdpr-article-4-definitions// GDPR Art. 4: Definitions (prerequisite) ↳ eu-gdpr-article-34// GDPR Art. 34: Communication to data subject ↳ edpb-guidelines-breach-notification// EDPB Guidelines 9/2022 // Result: 4 receipts, 4 on-chain txids: complete chain provenance ENTERPRISE ATTESTATION Institutional-grade audit evidence ENTERPRISE Available Multi-node chain attestation When your agent follows a dependency chain, consulting GDPR Article 33 and its prerequisites, the full chain is attested in a single audit record. COMING Q3 2026 Signed PDF export Convert any compliance receipt or chain attestation to a signed, print-ready PDF for inclusion in audit submissions, board reports, and regulatory filings. COMING Q3 2026 W3C Verifiable Credential Export compliance receipts as W3C VC-format digital credentials, machine-verifiable and interoperable with enterprise identity and audit platforms. COMING Q4 2026 Agent identity verification Cryptographically bind your AI agent's identity to the compliance receipt, proving not just what was consulted, but which agent consulted it. GETTING STARTED Using receipts in your audit workflow today 1 Capture the receipt block Every vault API response includes _receipt at the top level. Extract it before processing the node content. const { _receipt, ...nodeContent } = await vaultResponse.json(); 2 Store it alongside the action Record the receipt in your audit log next to the compliance action your agent took. The association matters. The receipt proves the specific intelligence behind the decision. await auditDB.insert({ action_id, receipt: _receipt, agent_id, timestamp: _receipt.accessed_at }); 3 Verify on demand At any future point, verify the receipt by comparing the integrity_hash against the live discovery endpoint. If they match, the content is unchanged. If not, the regulation was amended after the consultation. const live = await fetch(`https://bidda.com/api/v1/nodes/${_receipt.node_id}.json`); const { verification } = await live.json(); const isUnchanged = verification.integrity_hash === _receipt.integrity_hash; 4 Include the statement in filings The statement field is a human-readable audit string. Paste it directly into audit submissions, board reports, or regulatory filings. // _receipt.statement: // "Access to eu-gdpr-article-33 v2.1.3 verified at 2026-05-01T09:32:14.000Z. // Integrity hash sha256:a3f9... recorded at time of access." 7 AVG CITATIONS PER NODE 0 SCHEMA VIOLATIONS 0 BROKEN DEP LINKS Weekly SOURCE INTEGRITY CHECK START BUILDING YOUR AUDIT TRAIL Every node unlock is a compliance record. Start at $0.01. Pay-as-you-go is live now. No account, no subscription. Enterprise plans add chain attestation, signed PDF export, and unlimited unlocks. BROWSE 10,108 NODES ENTERPRISE PLANS SPEAK TO A SPECIALIST