Zero-Trust Flight Recorder
For Autonomous Lending Decisions
Transforms mutable AI logs into post-quantum cryptographic receipts with zero critical-path latency overhead. Engineered to meet strict EU AI Act Article 19, DPDP Act, and RBI regulatory standards.
Applicant Loan Portal
Simulate loan requests evaluated by algorithmic underwriting rules. Features strict EU AI Act natural person identity validation and sub-5ms client responses.
- ✓ Natural person identifier verification
- ✓ Instant prime & subprime risk tiering
- ✓ Automatic out-of-band audit dispatch
Live Flight Recorder Log
Real-time visual feed of the append-only RFC 6962 Merkle tree. Observe new SHA-256 leaf hashes sealed out-of-band without customer latency.
- ✓ Live Signed Tree Head (STH) root hash
- ✓ Real-time SHA-256 leaf hash feed
- ✓ Fail-open signed loss entry monitoring
Auditor Verification Studio
Air-gapped 100% in-browser cryptographic verification studio. Validate the 7 Northwind Cipher domains on any receipt with zero server trust.
- ✓ Client-side Web Crypto SHA-256 binding
- ✓ Ed25519 & ML-DSA-65 post-quantum hybrid
- ✓ 1-Bit tamper attack detection simulator
How CooL Powers The Zero-Trust Flight Recorder
From high-speed credit underwriting to post-quantum Merkle sealing: explore the five architectural stages that transform mutable logs into legally admissible mathematical evidence under EU AI Act Article 19.
The CooL SDK Architectural Philosophy
Never Sit in the Critical Path
The capture hook fires asynchronously into an in-memory ring buffer. Borrowers receive loan decisions in < 2ms with fail-open signed loss safety.
Sensitive Data Stays in Customer Boundary
Raw PII, financial histories, and credit scores never cross external boundaries. Only deterministic cryptographic hashes are appended to the transparency log.
Deterministic Canonical Serialization
RFC 8949 Canonical CBOR enforces exact byte agreement across diverse hardware architectures, eliminating hash mismatch ambiguities.
Hybrid Post-Quantum Cryptography
Dual signatures pair classical Ed25519 (64-byte speed) with NIST FIPS 204 ML-DSA-65 (3,309-byte lattice security) to guarantee a 10-year regulatory retention horizon.
RFC 6962 Merkle Transparency Tree
Cryptographic append-only logs prove inclusion with O(log n) audit paths and prevent retroactive history rewriting through Signed Tree Heads (STH).
Cryptographic Lifecycle of an Autonomous Credit Decision
Ingestion & Article 19 Guard
Borrower submits credit application. The API validates natural person identities, rejecting machine tokens (svc:*, client:*) under EU AI Act Article 19, and executes underwriting rules in < 2ms.
Out-of-Band Capture Hook
The CooL gateway hook intercepts the decision asynchronously into a bounded queue. Fails open on extreme load, logging signed loss entries with zero dropped loans.
Canonical CBOR & SHA-256
Background sealer encodes the decision data into deterministic RFC 8949 CBOR bytes and computes a 256-bit binding digest that catches any 1-bit tampering.
Hybrid Post-Quantum Sealing
The record is signed simultaneously with classical Ed25519 and post-quantum ML-DSA-65 (NIST FIPS 204), ensuring 10-year quantum resilience.
Merkle Log & Zero-Trust Audit
Appended to the RFC 6962 transparency tree. Regulators verify the 7 Domains directly in their browser with Web Crypto and test the 1-Bit Tamper Simulator.
Applicant Loan Evaluation
The Trigger: Algorithmic Underwriting Ingestion & Natural Person Guard
Live Transparency Engine
The Transparency View: RFC 6962 Merkle Tree & Telemetry HUD
Auditor Verification Studio
The Proof: Zero-Trust 100% Client-Side 7-Domain Audit
Drop receipt.json here to verify
or click to browse local filesystem
Select any of the 4 pre-built test cases below to simulate real-world audit scenarios directly in the browser or via CLI:
Valid CBOR payload, matching SHA-256 digest, Ed25519 & ML-DSA-65 signatures, Merkle proof, and natural person identity.
Single bit flipped in the SHA-256 payload digest. Fails Domain 02 (Binding) & Domain 05 (Consistency).
Corrupted classical digital signature bytes. Fails Domain 03 (Signature Authentication).
Identity is set to machine service account (svc:automated_bot), violating EU AI Act natural person requirements.
# Run air-gapped verification directly from terminal:
$ python src/verifier/cli.py \
--receipt case1_valid.json \
--public-key akyOBbMOxps6vQpOCK5outw7+XKm+0nZtxa/cRdzrWs= \
--root afe24a6a78a40f75b9546c20c7026277bfbcf11640e0eb7aadc44e2ae063e945
# Or output machine-readable JSON:
$ python src/verifier/cli.py --receipt case1_valid.json --jsonRFC 8949 CBOR deterministic serialization
SHA-256 payload digest match (Browser Web Crypto)
Ed25519 & ML-DSA-65 post-quantum hybrid signatures
RFC 6962 Merkle tree audit path validation
Monotonic append-only log verification
Hardware TEE quote status (Enclave simulation mode)
Independent multi-party co-signers
// Drop a receipt above or click 'Verify System Receipt' to inspect decrypted fields