The complete solution · Core 2 · the protocol

The tamper-resistant protocol

Neither an agent nor a person can act in the system
and cover their tracks.

Core 1Models & stations Core 2Agentic OS Core 3Tailored automation

An audit trail that survives the people who could rewrite it. Auditors, supervisors and courts can trust the record without trusting you or us.

3 promises

Nothing can be changed quietly.

01Recorded before it happens.Every action the system takes is written to the log first.

02Copied outside within seconds.The log's seals leave the building to independent witnesses.

03Checked without trusting us.Anyone can verify a record offline with an open verifier.

A witness is an outside computer holding copies of the log's seals, so no one rewrites it quietly.

3 use cases

What it settles, a year later.

The auditorA credit decision, re-checked.A year on, the auditor sees what the model read, what it proposed and who approved it. In your terms: an immutable audit trail.

The supervisory authorityA filing read, not assumed.The authority verifies that the filing was read, and when. In your terms: supervisory evidence.

The dismissed employeeNo claim that the log was edited.The log cannot be changed afterwards, by anyone. In your terms: non-repudiation.

What it means

For the supervisor, the auditor, and the court.

For the supervisory authority

An AI that cannot act unrecorded.

Every model call, every tool, every approval: in the log before it happened. The evidence pack is one click on the reply.

For the auditor

A history nobody can rewrite.

Not administrators, not FinqUP, not a restored backup. An auditor can run a witness.

For the court

Evidence that holds years later.

Signed with keys built to be renewed. Stamped by a public timestamp.

Who runs a witness

FinqUP: A witness run by FinqUP, independent of the institution.
Peer stations: Stations of the same or other institutions witness each other.
Auditors and supervisory authorities: Can run a witness and hold their own copy of every checkpoint.
Nobody alone: A verifier accepts a checkpoint only with enough independent witnesses. Collusion would need all of them and the public timestamp.

2 apps on the protocol

Signatures that hold, and an agent that cannot go rogue unseen.

Clerk Sign

Clerk Sign for internal and standard signing, verifiable in any PDF reader. Qualified signatures, where a consumer process needs one, come through qualified trust service providers. Evrotrust is already integrated.

Keys never leave the signer's device. A FinqUP root and FinqUP time stamps. Every envelope is an entry in the Trust Log.

Clerk Watch

Reads the log for rogue-agent behaviour: an agent outside its policy, a vanished log, a changed key. It alerts by default.

Blocking an agent is an owner's decision, never a silent one.

Tamper-resistant, never tamper-proofWe say tamper-resistant and tamper-evident. Never tamper-proof.

What it provesWhat each record says, and that nothing witnessed was altered. Not that a record was true.

What it does not coverActions taken outside the system. Completeness rests on write-before-act and Clerk Watch.

Ask for the protocol specification →Open verifier · published trust file · witness on request

Trust and procurement

What we supply for the ICT third-party register and the security questionnaire.

One supplier, on your premises, terms on the table. Local AI shortens the register entry. It does not replace your governance.

Register or questionnaire item	What you receive from FinqUP
Service description	Clerk OS, the apps and agents in scope, the model tiers and the machines. Written per deployment.
Data location	Your premises. Nothing is processed elsewhere.
Subcontractors	None. No cloud sub-processor chain.
Exit plan	Keep what is on your machines: the model, the agents, the integrations, the Trust Log.
Audit and access rights	On-site audit and access to the machines, the configuration and the log. A witness your auditor can run.
Outbound connections	The outbound-connection list per deployment. None at all on an air-gapped node.
Information security	ISO/IEC 27001 certified.
Traceability	Every AI action in the Trust Log. Evidence packs per request. An open verifier.
AI Act logging	Answers the logging duty for high-risk systems (Articles 12 and 26(6), from 2 Dec 2027) by design.
Standards	The same transparency-log primitives as certificate transparency. An IETF SCITT profile is on the roadmap.
Third-party incidents	1 in 3 major ICT incidents under DORA in 2025 came from a third party (ESAs, Jun 2026). Clerk OS removes the third party.

Asked by procurement	Answer
How big is FinqUP?	4 institutions in production. ISO/IEC 27001 certified.
Who runs it day to day?	Your IT, trained by us, with us on support. No remote access by default.
Is a local model good enough?	Tuned for office work. Measured on your own held-out documents before acceptance. Frontier cloud models still lead on general knowledge.
Capex and refresh?	Paid once, on standard parts. 2-year warranty, and updates you apply yourself.
Bitcoin sounds exotic.	It is only a public timestamp. The witnesses are auditors and supervisory authorities. The log verifies without it.
Advanced or qualified signature?	Advanced for internal and standard signing, verifiable in any PDF reader. A qualified signature through Evrotrust and other qualified trust service providers where the law requires it.
What about the EUDI wallet?	Accepted through the same trust-service integrations as wallets arrive. States offer them by 24 Dec 2026. Banks must accept them by 24 Dec 2027.

Request the procurement pack →Reference calls · architecture notes · outbound-connection list

For engineers

How it works, for engineers

6 steps, every time, for every action. Measured on the station.

01Write before actNo agent acts, and no person changes a record, before the record is in the log. A missing record shows as a gap.

02SealThe log is a Merkle tree. Within seconds the station signs a checkpoint with two keys, one post-quantum.

03WitnessIndependent witnesses outside the building countersign. A witness never signs two conflicting histories.

04AnchorCheckpoints are anchored in Bitcoin and bracketed by public randomness beacons. A local clock cannot back-date.

05VerifyAnyone checks a record, a signature or a whole evidence pack offline. No trust in FinqUP needed.

06Erase, keep the proofPrivate facts enter only as salted commitments. A person can be erased under GDPR. Every proof still verifies.

Measured on the station	Value	What it means
Storage per record	about 93 bytes	A million AI actions is a small database.
Capture of one event	0.24 ms	Logging before acting costs nothing a person can notice.
Signing a checkpoint	9 ms	Sealed within seconds of growth. A heartbeat even when idle.
Verifying a bundle	0.3 ms · 9 KB	A verifier runs on a laptop, offline.

The record that cannot be rewritten

Own your intelligence.

And own the proof of everything it did. Next: how we fit all of this to your institution.

Core 3 · the methodology →Back to core 2 · the apps →

info@finqup.com · a person answers

Neither an agent nor a person can act in the systemand cover their tracks.