The EU AI Act expects high-risk AI systems to keep records of what they did. That is manageable — until someone exercises their right to be forgotten, and the record you are obliged to keep contains the very data you are obliged to destroy. This system honours both duties at once: the personal content is destroyed beyond recovery, and the proof that the record existed and was never altered survives.
Every event a system in scope produces leaves a dossier entry: what class of thing happened, when, and a cryptographic commitment to the content. The entry is anchored, so its position in history is fixed and cannot later be backdated or quietly moved.
When a person asks to be erased, the content is crypto-shredded — unrecoverable, permanently. What remains is not a gap or an error: ERASED is a first-class, honest status that says plainly that a record existed here, that it has not been tampered with, and that its personal content is gone. You can erase, then verify again, and the verification still passes.
The dashboard shows evidence coverage per system, and an anchor ladder that stays honest about where each record actually is — accepted, included, or independently verified — rather than flattering the picture.
The check that matters is not the green tick we render. It is the standalone verifier — a released tool that runs the same check offline, from a clean checkout, on a proof bundle you have downloaded. If our dashboard disappeared tomorrow, your evidence would still verify.
That is also why the demo includes its own negative control: a deliberately tampered bundle, which must fail, and must name the reason it failed. A verifier that never says no is worthless.
An evidence-coverage figure rendered exactly as the engine computed it. The interface never invents a metric of its own.
Take the evidence with you and check it on your own machine, with the released verifier, offline.
Crypto-shred a demo subject and watch the record turn ERASED — while verification still passes.
Infrastructure that oversells itself is worse than none, because people rely on it for things it was never built to do. So, plainly:
The demo runs the full path in about thirty minutes, negative control included — and you leave able to verify the evidence yourself, offline, without us.