Legal

Disclaimer

Last updated 9 October 2026

Provenrail is evidence tooling, not legal advice and not a compliance guarantee.

No warranty

The software is provided "as is", without warranty of any kind, to the fullest extent permitted by law. See the MIT and AGPL-3.0 license texts that ship with the code.

What it proves, and what it does not

Provenrail makes records that reach the sink tamper-evident and independently verifiable. It does not and cannot prove completeness: an agent that never calls the SDK will not appear in the record. This limitation is stated throughout the product and the specification, not hidden in fine print.

Compliance

References to the EU AI Act, HIPAA 164.312(b), 21 CFR Part 11, PCI DSS, ISO 42001, SOC 2, or eIDAS describe how Provenrail's technical controls map to those frameworks as supporting evidence. They are not certifications. Your organization remains responsible for its own compliance, certification, and attestation. Provenrail does not act as a HIPAA business associate.

"Take to court"

This describes the design goal of producing independently verifiable evidence. The admissibility and weight of any evidence are decided by the relevant court or authority, not by us.

Undo, stop and the supervisor

Undo is a convenience for recovering a working tree, not a backup. It covers only what the documentation lists, checkpoints are pruned after 14 days, and a checkpoint may not exist if the hook did not run, failed or timed out. Keep your own version control and backups. Stop takes effect at an agent's next tool call and only for agents that run the hook. pr scan screens known auto-run surfaces; "nothing found" does not mean a repository is safe. The phone remote depends on a third-party service you choose, and we are not responsible for that service's availability, security or handling of your messages.

Legal advice

Nothing in this repository or on the website is legal advice. Consult qualified counsel in your jurisdiction.