AI Governance & Compliance

Every AI action logged. Every write governed. Every cross-platform data flow traced. Append-only audit trail, tamper-protected at the database level.

Start Free

Compliance at a Glance

EU AI Act Article 12
Aligned

Full event logging, traceability across AI lifecycle, human oversight on write actions

GDPR Accountability (Article 5)
Aligned

User attribution on all actions, consent-based write approvals, data lineage tracking

Log Retention
5 Years

All audit entries retained for 5 years, searchable by user, tool, date, or chain hash

Log Integrity
Append-Only

Database triggers block UPDATE, DELETE, and TRUNCATE on audit logs — enforced at PostgreSQL level

Six Layers of AI Governance

1

Write Governance

Every write action — sending emails, updating records, posting messages, moving data — requires explicit human approval before execution.

  • AI prepares the action and shows exactly what it will do
  • User clicks YES or NO — no silent execution
  • Approval decision recorded with timestamp and user ID
  • Session keys prevent replay or re-use of expired approvals
2

Append-Only Audit Trail

Every action is logged to a tamper-protected PostgreSQL audit table. Entries cannot be modified, deleted, or truncated.

  • Database triggers block UPDATE, DELETE, and TRUNCATE operations
  • Attempting to delete returns: "oc_audit_log is append-only. Modification and deletion are blocked for Article 12 compliance."
  • Every entry includes: user, tool, agent, action type, arguments, result, latency, timestamps
  • 5-year retention — searchable by any field
3

Cross-Platform Chain of Custody

When data flows between platforms, OneConnecter automatically links the source and destination. No model involvement — server-side detection.

  • Each routing chain gets a unique UUID (chain hash)
  • Every step in the chain inherits the same hash
  • When a write follows a read from a different platform, source_chain_hash is auto-populated
  • Cross-instance durable — source chain lookup is DB-backed (PostgreSQL), surviving serverless cold starts and Vercel instance isolation
  • One click from destination write → source read. Full cross-platform data lineage.
4

Full Action Visibility

Every AI action is recorded with complete context — not just the result, but the full decision chain that led to it.

  • What the user asked
  • What the AI decided to do
  • Which tools it used and with what arguments
  • Whether the action was approved, blocked, or pending
  • The final result and execution time
5

Model & Client Identification

Every audit entry records which AI model and client made the call — detected server-side from request headers, not self-reported by the model.

  • OC AI Gateway: exact model logged (e.g. google/gemini-3-flash)
  • Claude Desktop: detected as claude-desktop
  • Claude Code: detected as claude-code
  • Server-side detection — models never self-identify (they could lie)
6

Session & User Attribution

Every action is attributed to a specific user. Login and logout events are recorded, creating a complete session timeline.

  • User ID, email, display name, and role on every audit entry
  • Login/logout events recorded with authentication method (password, Google, GitHub, Discord)
  • Team-level visibility: admins see all team member activity
  • Full session bookending: who was active, when, and what they did

What Cross-Platform Traceability Looks Like

Real example: user reads contacts from HubSpot, then writes them to Google Sheets. OneConnecter links the chains automatically.

Chain A: 32e5312a... (SOURCE — HubSpot)
Step 1 [read]    queryData → hubspot_service_agent — 4,060ms
Step 2 [source] hubspot-search-objects → 3 contacts — 1,738ms
↓ data flows cross-platform
Chain B: f7118366... (DESTINATION — Google Sheets)
source_chain: 32e5312a... ← linked to HubSpot
Step 1 [read]         queryData → google_service_agent — 3,766ms
Step 2 [destination] sheets_append → pending_confirmation — 47ms
Step 3 [destination] sheets_append → approved → success — 1,270ms

Click the Sheets write → see source_chain: 32e5312a → click through → see the HubSpot read. Full data lineage in one click.

Tamper Protection

Attempting to delete or modify any audit log entry returns:

Error:
oc_audit_log is append-only. Modification and deletion are blocked for Article 12 compliance.

Enforced by PostgreSQL triggers on UPDATE, DELETE, and TRUNCATE. Schema changes (adding columns, creating indexes) remain permitted. Row data is immutable once written.

Architecture & Infrastructure

Audit Database

Neon PostgreSQL — append-only with trigger protection

Authentication

Supabase Auth — email, Google, GitHub, Discord

Hosting

Vercel — serverless, EU/US regions, SOC 2 compliant

Encryption

TLS 1.3 in transit — AES-256 at rest (Neon managed)

Your AI is making decisions. Can you prove what it did?

Free plan. Full audit trail. No card required.

Start FreeBook a Demo