For compliance and legal

Most tools make you build the evidence afterwards. This page is about what already exists.

What you can produce today

From the console, both are on Settings → Reports. If your team runs the runtime themselves, the same three commands produce it from the machine's own audit trail, with no account involved:

memnox report                   # the evidence bundle, markdown or JSON
memnox compliance controls      # every mapped control, with its evidence
memnox compliance summary       # one line per framework

compliance controls is the one to run first. It lists each control mapped against SOC 2, ISO 27001, HIPAA and GDPR, its current status, and the evidence behind that status, which is the shape an auditor's request usually arrives in.

The four claims you can actually defend

1. Every AI action was decided by a rule, and we can name it

Every request appends exactly one audit event recording the policies that matched, the advisory signals, the risk level, and the verdict.

Crucially it also records policyVersion, the content hash of the rule set in force at that instant. So a decision from March is explained by the rules as they were in March, not as they are today.

2. A named human approved anything that mattered

require_approval grants are bound to an action fingerprint, single-use, and record the approver. Quorum rules record each grant separately; one person counts once.

Break-glass overrides require a reason, are audited as critical, and open an incident. Irreversible actions refuse break-glass outright.

3. Nothing was decided by an AI

Policy evaluation, risk classification, guards and the security baseline are all deterministic, no model, no network, no randomness. The same input produces the same verdict, and memnox replay demonstrates it rather than asserting it.

The one place a model runs is decision extraction, whose output is a suggestion until a named person approves it.

4. The record has not been edited

Each event stores prevHash and a hash over its own canonical content.

memnox audit verify
# Audit chain intact — 128401 events verified.

The record of processing

Memnox keeps its Article 30 record as code, and a test asserts it covers every table in the schema. Adding storage without classifying it fails the build.

Each table carries its personal-data category, lawful basis, erasure strategy and at-rest coverage. See Privacy and retention.

That is the artefact to ask for first, it is generated from reality rather than maintained alongside it.

Subject requests

Erasure applies the per-table strategy and returns a receipt: which tables, how many records, by which strategy. Keep the receipt, it is the evidence the request was honoured.

Where deleting would break the audit chain, the strategy is crypto-shredding: the row stays and its key is destroyed, so the content is unreadable and the chain still verifies. Explain it that way; it is an honest trade rather than a loophole.

Retention

Two independent windows, both deliberate:

• source events, to the plan's history window;
• audit events, to --audit-retention-days on the deployment.

Pick both consciously. "Nobody decided" is the answer that causes trouble.

Access review

Three roles, and the split is on write, not read: viewers see everything and change nothing. Departed staff should be suspended, not deleted, deleting takes their approvals out of the record.

Where SCIM is configured, joiner-mover-leaver is your IdP's job and the evidence is its logs plus this list. See SSO and SCIM.

Questions auditors ask, and where to look