Live demonstration · nothing is sent anywhere

Show them the part that matters. Prove the rest is untouched.

When a court orders you to produce evidence of how your AI behaved, you have two bad options and one good one. Hand over everything, and disclose your customers, your costs and your model. Hand over a summary, and be asked why it should be believed. Or hand over exactly what is relevant, and let the other side check for themselves that nothing else was altered, removed or renamed. That third option is a construction, not a promise — and this page is it, running in your browser.

One record, as the other side receives it
decisionyield_and_halt
modelVersionobstacle-net 4.2.1
confidence0.91
safetyOverridefalse
contractRefwithheld — commercial
operatorOnDutywithheld — personal data
modelWeightsDigestwithheld — trade secret
commitment sealed 14 May
computing…
Recomputes exactly, with three fields missing
loading the evidence core… SHA-256 · RFC 6962 · Ed25519 zero network requests
Why this page exists

The high-risk deadline moved. The liability regime did not.

Most of the attention in the room goes to the EU AI Act, and its high-risk obligations are now some way off. The nearer date is a different instrument, it needs no regulator to activate it, and it turns an absent record into an argument against you.

days

Directive (EU) 2024/2853 — the new Product Liability Directive — applies from 9 December 2026. Software and AI are products under it, and liability does not require anyone to prove you were careless.

The provision that matters to an evidence layer is the disclosure one: a defendant can be ordered by a court to produce the relevant evidence at its disposal — and where that order is not met, the court may presume the product was defective. The absence of a record stops being neutral. It becomes the claimant's strongest exhibit.

Dates below are drawn from the same public ruleset our sister product classifies against, so this page cannot quietly drift from the engine. Indicative — confirm the final published text for your market with counsel.

Act 1 · The record

A record's identity is not the hash of the record

Hash a document and you get one number for the whole thing. Remove a line and the number changes, so a redacted document can never be checked against it. SureWard commits to a record differently: one salted leaf per field, combined into a Merkle root. That root is the record's identity, and — as the next act shows — it survives the removal of any field.

Act 1 Seal an operational record

Meridian Robotics Kft. operates autonomous vehicles in a Kecskemét distribution centre. On 14 May 2026 one of them classified an obstacle and stopped. On 3 August a claim was filed. This is the record its systems wrote at the time — the field values are edited live, so the commitment below is computed from what is actually on your screen.

FieldValueLeaf
record commitment
Edit any value and watch the commitment move. That is the easy half.
Why every field carries a random salt Without one, a withheld field is only as private as its value space is large. A withheld safetyOverride has two plausible values; an opposing party would hash both against the disclosed leaf and read the answer in under a second. The salt is exactly sixteen bytes, and every component of the leaf carries its own length prefix — because an earlier version of this construction allowed at least sixteen, which let the leading characters of a value be pushed into the salt. A payout of 12345 could be re-presented as 345 with a salt two bytes longer, producing a bit-identical leaf and an identical commitment. Found by adversarial review on 31 August 2026, before anything used it.
Act 2 · Disclosure

Withhold three fields. The commitment does not move.

The claimant is entitled to the decision, the model version and the state of the safety controls. They are not entitled to the operator's staff number, the commercial terms, or the digest that identifies the model weights. Withhold those three and the other nine still check out — against the same commitment as before, with nothing recomputed and nothing re-signed.

Act 2 What the other side receives
checking
recomputing the commitment from the disclosed fields
FieldDisclosed to the claimantLeaf
commitment sealed on 14 May recomputed from this disclosure

Now try to cheat. Each of these is the move a party would actually make.

What a withheld field still tells the other side A withheld field is visible as a withholding, not a silent absence. The recipient sees that a field exists, what it is called, and that it was not shown — and the name is separately committed, so it cannot be relabelled into something more comfortable. That is the difference between redaction and deletion, and it is the difference a court will care about. What the recipient cannot do is learn the value.
Act 3 · The second tree

Prove one record belongs. Disclose no others.

There are two Merkle trees here, and they do different jobs. The first, in Act 1, is built over the fields of one record — that is what makes redaction checkable. The second is built over the records of a log, and it is what lets a single record be proved to belong to the whole without producing the whole. One tree protects the inside of a record; the other protects its place in history.

Act 3 An inclusion proof over twelve days of operation

Twelve records were written that fortnight. The claim concerns one of them. Pick it and the page computes the audit path: the handful of sibling hashes that let anyone recompute the published root from that one record — without seeing any of the other eleven.

published log root path length
select a record
the proof is recomputed in your browser each time
Why this is the commercially interesting one Disclosure is expensive and it is dangerous. Every extra record handed over is another document the other side can build a case from, another customer whose data left your control, and another hour of review. An inclusion proof means the size of what you disclose is set by relevance, not by the shape of your storage. Twelve records here; the arithmetic is the same at twelve million, and the path only grows with the logarithm.
Act 3b A consistency proof — nothing was rewritten between two looks

An inclusion proof says a record is in the log now. It does not say the log is the same log you were shown last quarter. A consistency proof does: it demonstrates that the earlier root is a prefix of the current one, so records were appended and none of the earlier ones were edited, reordered or removed. This is the property people are reaching for when they say "blockchain" — and it is a 1962-vintage tree with no chain, no consensus and no token.

root at the audit on 20 May root today
checking
Act 4 · Your turn

Break the chain, with the keyboard in your hand

The records are also linked to each other and signed in position. Every button below is an attack somebody would really try, in ascending order of sophistication — ending with one that assumes the attacker holds our signing key. Verification runs on your machine, so nothing you do here reaches us.

Act 4The append-only chain
Chain intact
Every record recomputes, links to the one before it, and carries a valid signature for its position.
Attacks stack. Turn on 1 through 4 in order and watch where the failure moves.
The line an auditor writes down
The architect's question

Why these choices, and not the fashionable ones

Nothing on this page is novel cryptography, and that is the point. Every primitive here is old, standardised, and implemented in tooling the other side's expert already trusts. Novel constructions get attacked in cross-examination; boring ones get recomputed and conceded.

SHA-256 · FIPS 180-4

Deliberately boring

An opposing expert recomputes our hashes with sha256sum and no software of ours. A hash function chosen for novelty is a hash function you will spend a day of testimony defending instead of using.

Ed25519 · RFC 8032

Deterministic by construction

Signing is deterministic, so there is no per-signature random nonce and therefore no nonce-reuse failure — the mode that has repeatedly leaked ECDSA private keys in the wild. Keys are 32 bytes and verify with stock OpenSSL.

RFC 6962 · the CT tree

The tree every browser already trusts

Certificate Transparency's tree, unmodified: leaves prefixed 0x00 and interior nodes 0x01, so a subtree root can never be presented as a leaf. Odd nodes are promoted, never duplicated — duplication is CVE-2012-2459, where two different record sets share a root.

Salted field leaves

Redaction without recomputation

Because a record's identity is a root over its fields, removing a field leaves the identity intact. Nothing is re-signed at disclosure time, so the signature the other side checks is the one made when the record was written — not one made by lawyers afterwards.

Canonical JSON

Same facts, same hash, always

Keys sorted recursively, no whitespace, so formatting can never break a check. One subtlety that bit us: a payload field named __proto__ vanished from the canonical form while remaining visible in the record. The accumulator now has a null prototype.

Domain and chain binding

A signature knows where it lives

Signatures cover domain ‖ chainId ‖ seq ‖ prevHash ‖ recordHash, so a valid signature cannot be moved to another position, another log, or another company. For a product whose claim is this party did this, attribution is the one thing a signature must carry.

"So why not a blockchain?" What the question is usually reaching for is an append-only transparency log — and that is what an RFC 6962 tree with the two proofs above already is. It needs no consensus, no token and no network that has to outlive your evidence. Inclusion says this record is in the log, provable without revealing the others. Consistency says the log you saw last quarter is a prefix of today's. The remaining honest gap is a witness: somebody other than us countersigning the roots so we cannot present two different histories to two different parties. A qualified EU timestamping authority under eIDAS is exactly that witness, and it is on the roadmap below with a date.
Without us in the loop

Check a bundle you were handed

A verifier that needs our software, our servers or our cooperation is not evidence of anything — it is a request to be trusted. Paste a bundle below and it is checked here, in this tab. You can also take the file away and run it against bare node with nothing installed.

Nothing checked yet.
The same check, with nothing installed sw-verify is one file of plain JavaScript with no dependencies, no network calls and no configuration. It is short enough to read in five minutes and to reimplement in another language in an afternoon — which is the actual test of whether a record is checkable by someone who does not trust you.
# nothing to install; node 22+ ships everything it needs
node sw-verify.mjs bundle.json
# exit 0, or exit 1 naming the record and what did not match
Reality & roadmap

What is running, what is next, and what we will never claim

This is an early production beta and we would rather you heard the limits from us than found them. Each row says what is true today and what is committed, with a date. When a date moves, this page moves with it.

Where the line is on 31 August 2026

Everything you just used on this page is real code from the shipped library, running locally. The rows below are about what surrounds it.

running now
The evidence core. Redactable record commitments, an RFC 6962 tree with inclusion and consistency proofs, an append-only signed chain, and a zero-dependency offline verifier. Held by 65 tests, including every index of every tree size up to 64 and every old/new size pair up to 64 — plus a parity test that runs this page's copy against the library so the demo cannot drift from the product.
by design
Detection, not prevention. Nothing here stops a person with database access from writing whatever they like — this is tamper-evident, which is a different and more honest claim. It means they cannot do it quietly. Prevention is a control you already own; detection is what still works after that control fails.
at onboarding
Whose key signs. On this page the key is generated in your own browser and thrown away when you close the tab, which is why you could re-sign a forged chain in Act 4. In production the signing key is the customer's, issued per tenant during onboarding — we run that onboarding by hand today, deliberately, because the alternative is a self-service flow that mints keys nobody has thought about. Committed · with the first production tenant Customer-held keys as the default, so a record is non-repudiable by us as well as by you.
supplier, not code
Third-party time. Nothing on this page carries a timestamp. Our sister product already implements RFC-3161 timestamping end to end — it fetches a real token from a live authority, binds it to the tree root, and refuses a token issued over a different digest — but the authority used in development is a free public one, which is not eIDAS-qualified, and it is switched off in hosted environments today. Committed · before 9 December 2026 A qualified EU timestamping authority, selected per tenant and enabled during onboarding, so a sealed root carries the legal presumption of date and time that eIDAS attaches to a qualified timestamp. What stands between here and there is a supplier relationship and a per-tenant setting — not research. If it slips, this row changes before the sales deck does.
roadmap
A witness for the roots. Publishing tree roots to a witness who countersigns them is what closes the last honest gap — the one where an operator could show two different histories to two different parties. The qualified timestamp above is the first half of it. Next after the above Roots countersigned and published on a schedule, with the consistency proof between any two published roots checkable by anyone holding both.
not started
What the product does not have yet. No hosted API, no database, and deliberately no opinion about what a record contains — the field names in Act 1 are an illustration, not a schema. Deciding the taxonomy before the specification is written would be work thrown away. Dossier and Score, the two products that sit on top of this core, are not started.
never
What we will not do. We do not check a timestamping authority's own certificate chain — that is openssl ts -verify against roots you choose. A verifier that also vouches for its own trust anchors is asking to be trusted twice, which is the failure this whole page exists to avoid. And we will not tell you whether a record helps your case.
Why say all this out loud A liability-evidence vendor that overstates its own maturity has failed its own test on the first question. Everything above is checkable: the library is 65 tests, the verifier is one dependency-free file, and this page recomputes rather than asserts. Ask us for the parts that are not here yet, and we will tell you the same thing we have written down.