Technical reference
Compliance & standards
How the ledger satisfies the regimes your auditors, risk and legal teams ask about. Full mappings live in the repository (SOVEREIGNTY.md, THREAT-MODEL.md, COMPLIANCE-STANDARDS.md); this is the in-app summary.
Australia — APP 1.7–1.9
Decision Keep is the evidence layer, not the decision maker: it makes no decisions about individuals and holds no personal information about them. Each record stores system, agent, version and payload (the inputs). The signature and received_at prove exactly when and by what version a decision was made. The routing outcome distinguishes a decision made solely by the computer program (APP 1.8(b)) from one where the program substantially and directly supported a human decision-maker (APP 1.8(c)), which is what lets you disclose both categories accurately. The signature and hash chain let you produce the evidence for a specific decision on request, verified offline against your published key. The obligation applies from 10 December 2026 and sits with your organisation as the APP entity, not with us.
EU — AI Act Art. 12
The ledger is the automatic log for high-risk AI. AI-governance capture fields (risk, confidence, routing, human_verifier_id, reference_db_state) provide the model-logging and human-oversight evidence, and the ledger is exportable for technical documentation.
EU — GDPR
Storage limitation (Art.5(1)(e)) via per-org retention; right to erasure (Art.17) via signed cryptographic erasure that preserves the chain anchor.
United States
CCPA/CPRA §1798.105 right to delete via cryptographic erasure; Colorado AI Act and NYC Local Law 144 via the recorded record of the automated system and its logic inputs.
Frameworks
Standards & frameworks in scope
- SOC 2
- ISO 27001
- ISO 42001
- APRA CPS 234
- APP 1.7–1.9
- EU AI Act
- GDPR
- NIST AI RMF
- PCI DSS
Decision Keep is built to the controls these regimes require - signed evidence, tamper-evident chaining, retention and cryptographic erasure, and independent timestamps. Attestation status lives in the Trust Center.
Audit posture
Minimum vs Gold Standard
- ✓Decisions recorded and signed with your Ed25519 key
- ✓Tamper-evident hash chain active
- ✓Key published at /.well-known/record-public-key
- ✓Retention & lawful-erasure policy set
- ✓Audit trail intact
The irreducible floor. A receipt is defensible in court or with a regulator.
- ✓Independent RFC 3161 trusted timestamping (TSA_URL)
- ✓External auditor on the roster (verifies offline)
- ✓Live, recent activity
- ✓AI-governance metadata captured (risk, confidence, human oversight)
Optional checks that raise posture toward Silver/Gold but are not required to be defensible.
Your live score is on the dashboard (Audit readiness). The Gold Standard view exposes what is present, and what is still missing, for an evidence-ready posture.
Reading on the Australian obligation
The mapping above is a summary. The OAIC's obligations are specific, and the specific detail is where procurement decisions get made.
- APP 1.7–1.9 from 10 December 2026: what the new guidance actually requires — the three threshold conditions in APP 1.7, the three disclosure limbs in APP 1.8, and why human-in-the-loop decisions are usually in scope.
- Twelve questions to ask an AI decision vendor before 10 December 2026 — the procurement checklist, including whether a record can be produced for a decision taken six months ago.
- Audit-ready AI: how GRC teams prove every automated decision — the evidence an auditor asks for, and how to test a vendor's “auditable” claim.