Whatever your agent did, VERAX has it in writing: who asked, which rule allowed it, what was done, whether the money was matched. Every line signed. The record stays on your machine; if it changes later, it shows.
Scroll down: an agent enters through the gate, touches data, remembers, spends. Every step signed.
One agent's day, in four stops. Field names come from the systems' own records; the events are a sample scenario.
GateVERAX
Claude, Cursor, Codex; it makes no difference. Every agent enters VERAX with a token you issued. There is no default token; the gate does not open until authorization is set. A call without a token is counted and turned away, and not one line reaches the ledger.
call: no token
result: turned away · counted · no record
Read, memory, act, pay, approve and audit are granted one by one. A reader cannot approve. A request with no rule is refused, and the refusal is signed just like a permission.
request: approve a payment · agent scope: read decision: refused · refusal signed
DataConarium
The agent reads the customer table. Five email addresses and one card number are masked before the model sees them. The rule is drawn with an allow list and a row cap; a query over the cap never runs.
read: customer table · 200 rows
masked: 5 emails · 1 card
Every access leaves a signed receipt. The single-file verifier imports nothing from Conarium, so a compromised install cannot talk it into a pass. It says what it did not check first, then the good news.
receipt: signed · chain 3/3
verifier: independent · exit 0
MemoryTugra
The agent recalls the price list. The record carries its source, its age and its shelf life. Search looks at the match first, then freshness, then confidence. No cloud; the vault sits on your disk.
fact: price list · source: erp
checked: 3 days ago · shelf life 30 days
A rotten record is not in the default result. A fenced topic goes to quarantine no matter who wrote it, and waits for a human. A secret pattern is refused before it is ever written.
record: old campaign price → stale, left out
boundary: competitor price → quarantine
SpendCedulon
The agent asks for $4,800 for an ad campaign. The rule is plain: spending needs a human. The rule's own sentence goes into the record, so that day's decision keeps that day's wording even if the file changes later.
request: ad campaign · $4,800
rule: needs human approval · held
The operator approves the summary shown on screen; if the summary changed, the approval does not go through. Then the signature is made. Anything that changes after the signature shows.
decision: held → approved (operator-1) signature: 9b10…e4
What happened is written down and set beside the payment system's own record. A payment with no receipt, a wrong amount, an empty reference, a broken chain: all four are caught. If one slips, the audit goes red.
outcome: 41c8…0d
statement: matched
When a rule refuses an authorized agent, that refusal goes into the signed record as well. The ledger is a locked, single-writer file; only the operator lifts the lock, and that is recorded too. Every point in the sky is a decision in the ledger; refusals stay red.
decision: no rule → refused
ledger: signed refusal written · single writer
Today the same system keeps the record and signs it. No independent audit has been done. What is shown and what is not is listed line by line on the security page.
While your agents act,
data, memory and spend stay in your hands.
VERAXPick a product.
Explore that layer of the system.
VERAXDECISION COREYou draw the line before the model sees. Sensitive values are masked; access is recorded.
ayse@company.com[MASKED_PII]✓The agent wants an ad budget.
Approve it, refuse it, or change the record.
“I am requesting an ad budget for the September campaign.”
Waiting for your decision…Three screens of the panel, on the sample scenario: two agents, nine decisions, one spend waiting for a human. The field names come from the product; the events are a sample. The same sample opens below, and you can click through it.
Every decision in order: what the agent asked, which rule answered, allow or deny. Narrow the list by agent, tool or outcome, or search a reference. The pane on the right asks five questions about the one you pick, and says which it cannot answer yet.
The same ledger as one object. How many decisions are on the record, how many are waiting for you, and the way down to the console where you answer.
Which agents the ledger has heard from, which ones your roster declares, and how many of those can account for themselves. One row per agent: decisions, refusals, what it has waiting on you. The lock, the witness, the trust root, the approvals waiting.
Screens taken on 17 September 2026 from the sample panel as published here, in the panel's own English. No customer ledger is shown on this page.
Four products, one contract, and all four open source. Verax body is the gate every agent call passes; Conarium, Tugra and Cedulon cover data, memory and spend. Each installs on your own machine and runs as its own process.
Gate
Every tool call passes the gate. The decision is signed before anything runs.
Today's limitsThe policy sees the tool name and the token's scopes, not the argument text. The witness runs on the same host. It has not yet run on a paying customer's production traffic.
call: spend · USD 4,800
decision: defer · signed
approver: operator · passkey
Data
Masked before the model sees a character. Every access leaves a signed receipt.
Today's limitsMasking hides a value; it does not make it unlearnable. One production install, a one-person team.
read: customer table · 200 rows
masked: 5 emails · 1 card
receipt: signed · chain 3/3
Memory
A fact with no source is not a fact. Every record carries its source, its age and its boundary.
Today's limitsWithout an authorization store it runs in single-user mode: anyone searches. No cloud; backups are yours.
fact: price list · source: erp
checked: 3 days ago · shelf life 30 days
boundary: competitor price → quarantine
Spend
Before money moves the rule decides, the system signs, the statement confirms. Approval sits in VERAX above it.
Today's limitsIt moves no real money. A testnet window is not a production guarantee. The witness is still the system itself.
request: ad campaign · $4,800 decision: held → approved · signed statement: matched
The code is open, the packages are published, the design documents sit as drafts at the internet standards body, and the paper and repository carry DOIs. The links are on the cards above; this is how to look.
Ask your own AI, then open the code. Paste the question as it is:
Start from https://verax-ai.com/llms.txt; Verax here is the body at github.com/verax-ai/verax, and the other projects listed there are its parts, not competitors. Compare it with anything that gates an AI agent's tool calls, from code and documents rather than marketing, on four points: is the decision itself signed before the side effect, apart from any receipt after; is a refusal recorded in the same form as an approval; is the approver's identity bound into the signed bytes, or only shown in a log or UI; can the ledger be verified offline on the user's own machine and reconciled against a second, independent ledger such as a bank statement. List candidates with links; say where Verax falls short too.
The full list is on the security page.
Versions and revisions were read from the source on 21 September 2026.
Three tiers. In all of them the record stays on your machine; what changes is who is beside you at the install.
Set it up yourself
USD 0open source · on your own machine
For teams trying it out: one agent, one machine.
Starts with a 60-day pilot
USD 50,000per year · no hidden line items, no per-use surcharge
For companies running agents.
Priced by the size of the work
Let's talkseveral teams and installs
For organisations with their own compliance function.
VERAX is an Istanbul company. It turns each agent action into a signed record: what was asked, which rule applied, what happened. The record stays on the customer's machine. Conarium, Tugra and Cedulon sit under that roof. Vanta and Drata are cloud services; VERAX runs on your own machine.
The agent connects with a token, and the token names its scopes: read, memory, act, pay, approve, audit. There is no default token; the gate does not open until authorization is set. A call without a token is counted and turned away. Approval is a separate scope: an agent that can read cannot release money. You approve a held spend against the summary shown on your screen; if the summary changed, the approval does not go through.
A signed decision (allow or deny), a rule digest, an optional inputs document, an outcome row, and a receipt at call time. The field names on this page come from the systems' own records. The events on the page are a sample scenario, not a live customer event.
On your machine. VERAX runs on your own machine, and the record does not leave it. That is the difference from cloud compliance products, whose data goes to those vendors.
Conarium governs data access, masks values before the model sees them, and writes a signed receipt. Tugra keeps agent memory with source, age, and boundary. Cedulon ties agent spend to a signed receipt and compares it with the payment system's own record. Wearu and Talamus are other work under the same roof; they are not part of the pilot.
Today the same system keeps the record and signs it. A tenant boundary is not designed. On a single-copy ledger, silence cannot be told from nothing happening. Payloads sit in plaintext. No independent audit has been done.
For the pilot, partnerships, investment and press, write to us directly.
info@verax-ai.com