The floor stays free. The packs stay current.
Each pack extends the free verifier with the evidence one regime needs — and regimes drift, so we keep them current.
Where we fit.
Governance flags it. Evals score it. Logs record it. Guardrails block it. We re-derive it.
A signed receipt proves who issued a result. NEXIVERIFY lets anyone recompute it and check it re‑derives — so the producer’s label is never load‑bearing.
Compared against each vendor’s published documentation, May 2026. Positioned on mechanism, not marketing — we don’t claim to be first or only, only different in what gets re‑derived.
Open at the floor. Mandates at the ceiling.
One fixed annual number per band, scoped to your regime. Flat, never metered. The floor is free, forever.
When an auditor or regulator asks for the record behind one duty, you hand them a receipt they re‑check on their own machine — no call back to us.
- One HIPAA 164.312(b) audit control
- One ISO 42001 record control
- One SEC books‑and‑records line item
Evidence for a single named control. We never say “compliant.”
You can answer a whole regime’s record and logging questions, not just one clause — one emitter standing behind the full control set.
- EU AI Act Article 12 logging
- MiCA Article 68(9) CASP records
- DORA Article 10 log continuity
- MiFID II RTS 24 order records
- HIPAA 164.312(b) audit controls
- PCI DSS Requirement 10 log integrity
- ISO 42001 record controls
Evidence for that regime’s records. Whether every event was captured stays your system’s job.
For the rules where the regulator wrote the mechanism into the law itself, you get evidence built to that exact mechanism — the records most likely to be examined.
- SEC 17a-4(f) record recreation
- AI Governance Records Bundle (Article 12 plus ISO 42001)
- GxP and 21 CFR Part 11 audit trail and e‑signature
Evidence for the named mechanism. It is not a conformity certificate.
Regulations change every year. Each license keeps its emitter current — so the evidence stays valid year over year.
Each engagement is scoped to your regime, quoted as one fixed annual number, flat within a band. Year one includes the six‑week stand‑up. Paid in full upfront.
Tell us the regime and the controls in scope — request a quote and we send back one fixed annual number.
Built for the regulated enterprise.
Where an AI output has to stand up to an auditor, a regulator, or your own model-risk team.
A model fires a credit, fraud, or trading decision — and months later your model-risk team has to reconstruct exactly how, on the version that was live.
A clinical-AI tool surfaces a recommendation at the point of care — and an IRB, the FDA, or your own safety board asks what data and model stood behind it.
An AI coding agent commits an artifact into the build — and now a customer’s security team wants provenance for every machine-authored thing that shipped.
A model output ships embedded in the product — and a notified body or sector regulator expects it inside the technical file, traceable to its source.
You ship a frontier model into the world — and downstream deployers, and the GPAI transparency duty, ask you to attest what it was trained on and what it emits.
Your platform publishes millions of AI-assisted assets — and a rights-holder, a marketplace, or an EU disclosure rule wants provenance for any one of them.
You’re signing off an AI system into public service — and the sign-off rides on a vendor’s word your office has no way to re-check.
You sign an assurance opinion — and your name now stands behind an AI-derived conclusion you could not re-perform if a peer reviewer pressed you.
Open by floor. Defended at the edges.
Tamper-evident by construction. Re-run any receipt and it re-derives byte for byte, or it shows you exactly where it breaks.
Open at the floor
Apache 2.0 reference verifier. No proprietary base, no walled garden, no lock-in.
The open core is — open source under Apache 2.0. A dated independent audit precedes any production claim.
Independently re-derivable
Re-run it yourself: a receipt re-derives byte for byte, or shows where it breaks. No account required.
An independent attestation option is available on every pack.
