For freelancers and agencies

Give your client a receipt they can verify without trusting you.

You build and run AI agents for clients. When something goes wrong, or the client wants to know exactly what the agent did, you need more than a log file you control. Provenrail gives your agent a signed, tamper-evident record that a client can verify themselves with an open-source tool, on their own machine, without involving you at all.

The scenario

A client hired you to build an agent that processes their customer data, runs reports, and sends outgoing emails. Three weeks after delivery, they come back with a question: the agent sent an email that was not supposed to go out. They want to know exactly what it was given, what it decided, and when. You could describe what you think happened, but that is your word against a problem they experienced.

With Provenrail instrumented from the start, the conversation goes differently.

That last step is the point. The client did not have to trust you for the record to hold. They ran the verification themselves and got a cryptographic answer. That is a different class of professional relationship than a shared spreadsheet or a description in a Slack thread.

What the client actually receives

When you export a run, the client gets two files:

• A bundle file (JSON). Every event the agent recorded, with a hash of the previous event embedded in each record. The chain is signed by the agent's Ed25519 key and independently re-chained by the sink. Reordering, deletion, or insertion breaks the chain and the verifier reports it.
• A pin file. A signed checkpoint your agent wrote at the end of the session. It lets the verifier detect if records have been removed from the tail since the checkpoint was written, including by you after export.

On the Builder plan, each anchor also carries an RFC 3161 trusted timestamp from an independent time authority, so the timing of events cannot be back-dated. Every account gets one of those free, so you can put a real one in front of a client before deciding anything: sign in at provenrail.com/account, claim the key, then pr anchor-push bundle.json. Beyond that first one the Free plan's timestamps are local; the record still detects tampering and deletion, it just cannot prove when the run happened.

You can also send a hosted read-only proof link (Builder plan) instead of files. The client opens a URL, the verification runs client-side in their browser, and the evidence is presented. Nothing leaves their browser to check the proof.

Your prompts and your client's data stay private

The default mode is store-hash-not-content. Provenrail records a SHA-256 hash of each prompt and model response, not the raw text. The hash proves that a specific piece of content existed at a specific point in the chain and has not changed since. The raw content stays on your machine.

This means:

• Your system prompt and the instructions you wrote are never uploaded.
• Your client's input data is never uploaded.
• Model outputs are never uploaded.

What is uploaded: metadata about each event (tool name, timestamp, token counts, the hash of the content, the event type), the cryptographic chain that links events together, and the signatures that seal each session. That is enough to prove the sequence of events is intact without exposing the content.

If you need the client to be able to read the actual content later, you can opt into full content storage per-run by passing capture_content=True. That is an explicit choice, not the default.

Five-minute setup

Instrument your agent once. Every run is then recorded automatically.

Step 1: install and start a local sink

# Install the CLI and SDK
uv tool install provenrail

# Start a local sink and write .provenrail.json (no account, nothing leaves your machine)
pr quickstart

The local sink runs on your machine. Records are stored there until you export them. Stop it any time with pr quickstart --stop. Point it at a hosted sink for multi-machine setups.

Step 2: wrap your agent loop

One context manager captures every model and tool call inside it:

import provenrail as fr

with fr.record("client-project"):
    # Your agent runs here. Model calls and tool calls are captured automatically.
    result = run_agent(task)

If you use the Anthropic or OpenAI SDK directly, hand the client to the session and every call it makes is recorded:

import anthropic
import provenrail as fr

client = anthropic.Anthropic()

with fr.record("client-project", clients=[client]):
    # every call this client makes is now recorded
    result = run_agent(task)

Each run is a separate sealed session on the same stream. The first run creates .provenrail.key, a device signing key. Keep it out of version control alongside .provenrail.json.

Step 3: export and verify

# Export the full stream as a self-contained bundle
pr export my-run.json

# Verify it yourself before sending it anywhere
pr verify my-run.json

Send the client my-run.json and pin.json (written alongside the bundle on export). They can verify it with the same pr verify command, offline, without an account.

Optional: build a formal evidence pack

If the client or their legal team wants a structured report, pr pack produces a ZIP with the bundle, the verification result, and a plain-English summary:

pr pack my-run.json --regime generic --out client-evidence.zip

The --regime eu-ai-act and --regime hipaa variants map the evidence to those specific frameworks. The Team plan generates these from the dashboard in one click, without an export step.

What this is not

This section matters more than the feature list.

• Not a compliance certificate. Provenrail produces evidence. Whether that evidence satisfies a specific legal or regulatory requirement is a determination for you, your client, and qualified legal counsel. We do not issue compliance certificates and do not give legal advice.
• Not a guarantee of completeness. A record proves what was recorded. An agent that never calls the SDK at all will not appear in the record. If you need to show an agent had no opportunity to bypass recording, the sidecar proxy (pr sidecar) adds an out-of-process capture layer, but completeness is only as strong as the egress controls around it. We document this rather than bury it.
• Not a promise the client cannot dispute. The record proves what happened. If the client believes the record is forged, the verifier settles the question: either the math holds or it does not. But the record proving an event happened does not settle a question about whether the event was correct or authorised. Evidence and argument are separate things.
• Not content storage by default. As described above, the raw prompts and outputs are not recorded unless you opt in. The hash proves the content existed; it does not let anyone read it.

Regulatory context

The regulatory environment around AI is moving. Three dates matter for freelancers and agencies building agents for EU clients.

The Article 50 transparency duty is already in force. The Product Liability Directive reaches national law by 9 December 2026, a full year before Article 12 logging. Recital 46 of that directive states that where a product lacks the logging required by Union law, defectiveness can be presumed, shifting the burden of proof. A log you control is a log you could have edited; a tamper-evident, independently verifiable record is harder to argue away.

Provenrail does not make you compliant with any regulation. It produces the kind of evidence that sits at the base of a compliance argument: a verifiable record of what happened, when, in what order, and whether anything was altered after the fact. Whether the argument succeeds is for you and your advisors to determine.

For a detailed breakdown of the AI Act dates and what each article requires, see the full EU AI Act page.

Pricing

The Free plan is $0 and covers the core use case: hash-chain integrity, the open-source verifier, and the ability to export a bundle a client can verify themselves. It covers 50k events per month, which is roughly 200 to 500 agent runs depending on depth.

The Builder plan at $29 per month adds RFC 3161 trusted timestamps from an independent time authority (so timing cannot be back-dated, even by you) and shareable hosted read-only proof links your client can open in a browser without installing anything.

If you run agents for multiple clients and need separate projects, role-based access for team members, and one-click evidence packs from the dashboard, the Team plan is $99 per month.

The server is also available under AGPL-3.0 for self-hosting. If you or your client prefer to run the sink on their own infrastructure, that is a supported path with no license fee. See the GitHub repository.

Full tier comparison and pricing FAQ →

FAQ

Does my client have to trust me for the record to be valid?

No. The client downloads the open-source verifier and runs it themselves, or opens the hosted verifier at provenrail.com/verify. It recomputes every hash, signature, and timestamp locally without contacting Provenrail's servers. You do not have to be trusted for the proof to hold; the math does the work.

Does Provenrail see my prompts or my client's data?

No, unless you explicitly opt in. The default mode records a SHA-256 hash of each prompt and model response, not the raw text. The hash proves the content existed and has not changed; the raw content stays on your machine. Your client's data is never uploaded.

Can my agent fake or delete records?

A record that reaches the sink cannot be altered without the change showing. The hash chain makes tampering detectable, and on the Builder plan RFC 3161 timestamps from an independent authority prevent back-dating. However, an agent that never calls the SDK at all will not appear in the record. Provenrail detects tampering and deletion of records that were written. It cannot force an uncooperative agent to write in the first place. This is a documented limitation, not fine print. The sidecar proxy adds an out-of-process capture layer for higher assurance.

Does this make me compliant with the EU AI Act or the Product Liability Directive?

No. Provenrail produces evidence. Whether that evidence satisfies a specific regulatory requirement is a legal determination that rests with you and your advisors. We do not issue compliance certificates and do not give legal advice. What we do is produce the kind of independently verifiable technical record that sits at the base of a compliance argument.

How does a client verify the record?

You send them the bundle file and a pin file, both produced by pr export. They install the verifier: uv tool install provenrail (or pip install provenrail). Then they run: pr verify my-run.json --pin pin.json. It exits 0 and prints RESULT: VERIFIED if the chain is intact. No account, no data sent to Provenrail. On the Builder plan you can also send a hosted read-only proof link instead.

What does it cost?

Free: $0, 50k events per month, hash-chain integrity, open-source verifier, full export, and one independent RFC 3161 timestamp. Builder: $29 per month, RFC 3161 trusted timestamps, shareable client proof links. The server is also AGPL-licensed for self-hosting at no cost. See the pricing page for the full comparison.

Regulatory dates: EU AI Act Article 50 in force from 2 August 2026. Revised Product Liability Directive (EU) 2024/2853, national transposition due 9 December 2026. EU AI Act Article 12 deferred to 2 December 2027 for standalone Annex III systems by Regulation (EU) 2026/1744. This page is for engineering audiences and is not legal advice.