What is an independent witness for AI agent logs?

A third party that cosigns the checkpoints of your log and confirms each new checkpoint only adds to the last. If any record is changed or deleted, the witness signature no longer matches. The witness never sees the contents of the records.

Does Allibi replace my receipt or logging vendor?

No. Allibi does not issue receipts. Any log that uses the open transparency log witness protocol can request an Allibi cosignature and keep its existing format and vendor.

How are Allibi signatures quantum resistant?

Allibi cosigns with hash-based signatures (SLH-DSA), which do not rely on the mathematics quantum computers are expected to break. Every hour all witnessed checkpoints are rolled into one root and anchored to Bitcoin via OpenTimestamps, an RFC 3161 timestamp authority, and Base.

Independent witness for AI agent logs

The witness that is not you.

An agent acts and logs what it did. Who else saw it? Allibi did.

Get in touch

One hour of witnessing. Every log that submitted a checkpoint, one root, three public anchors.

epoch 2026-08-21 16:00 UTCwitnessed

bank-a / credit-review checkpoint 48,211

consortium-fraud / query-log checkpoint 9,904

vendor-x / receipts checkpoint 1,120,377

insurer-b / agent-ops checkpoint 3,002

platform-y / tool-calls checkpoint 77,540

+ 212 more logs this epoch

+ 215 more logs this epoch

epoch root

cosignedSLH-DSA (hash-based)

anchoredBitcoin via OpenTimestamps, RFC 3161 authority, Base

Your own log is your own word.

An auditor will ask whether you changed it later. Allibi answers for you.

Not you

We confirm your log only grew. Edit anything and our signature fails.

Not your data

We see checkpoints, never records.

Not going anywhere

Hash-based signatures, anchored to Bitcoin. Verifiable for decades.

How it works

Your log publishes a checkpointOrigin, size, root hash.
We cosign itAfter checking it extends the last one we saw.
Every hour we anchorAll cosigned checkpoints are Merkled into one epoch root, signed with SLH-DSA, and anchored to Bitcoin, an RFC 3161 authority, and Base.
Anyone verifiesRun allibi-verify on the bundle. No network, no login, no trust in us.

How this differs

Nothing to install, nothing to host, no data leaves your systems. Your log sends a checkpoint over HTTPS and gets a signature back.

	OpenTimestamps	Receipt and gateway vendors	Allibi
Proves a hash existed by a time	Yes, on Bitcoin	On their own clock	Yes, three anchors
Proves the log only grew	No	On their own chain	Yes, every checkpoint
Signed by someone other than the party being audited	No signer	No	Yes
Runs in your environment	A client	A proxy or agent	Nothing
Sees your records	No	Yes, in the request path	No, checkpoints only

We use OpenTimestamps as one of our three anchors. Vendors that sign receipts are who we witness, not who we replace.

Who this is for

Receipt and log vendors

Your spec has a box labeled witness. Put us in it.

Banks, insurers, consortiums

Require a witness for any agent that decides or touches shared data.

Auditors and examiners

Verify from the public anchor down. No platform access.

What we are not

Not a receipt issuer. Not a gateway. Not a data store. We sit beside the log you already run.

Limits: a witness cannot prove a log is complete, cannot judge whether an action was right, and cannot see a log that was never submitted. Certificate Transparency has the same limits.

Talk to us

Starting with a few vendors and regulated teams. If you make agent logs or rely on them, write to us.

received · Thanks. You will hear from us directly.