The AI section of your security plan · signed report
A signed annual AI-activity report
A signed annual AI-activity report adds a dated Ed25519 signature over the SHA-256 commitment this tool prints, so a reviewer can check the report was not changed after it was signed, and when it was signed. Only the commitment is sent to be signed: your log and report never leave your computer. The report itself is complete without it. $49 per report, once, through Stripe Checkout, with no account. You send only the report's SHA-256 commitment: never the report, the log, a client or a member of staff.
Start from your report
Write the year's report on your own computer, from the log it keeps. It prints the report's commitment and a link back here for that report, with the Pay button:
$ npx --allow-remote=root https://agentwares.vercel.app/dl/safeguards-log-0.2.0.tgz report --from YYYY-MM-DD --to YYYY-MM-DDHow it works
reportreads the firm's AI activity log and writes the period's report as Markdown, PDF and CSV on your computer, with a SHA-256 commitment over the files and the log's head. That part is free and sends nothing to us.- You pay $49 for that commitment, through Stripe Checkout.
- The page Stripe returns to shows a token. In the folder that holds the report,
sign --token <token>checks the report's files are as they were written, sends the token and the commitment, and writes the signed report's JSON and PDF beside them.
What the signature shows
That the report and the log's head have not changed since they were signed, and when they were signed. It does not show that the log is complete, or that the firm meets a rule: the report says what the firm's own exports recorded, and the signature dates it. Anyone can check a signed report with verify against the key published at /tax-firms/report-key.json.
Refunds: our refund policy. A draft for your counsel or Qualified Individual to review; not legal advice. Whether it meets a rule that applies to you is for you and them to decide.