Evidence infrastructure for machines whose software can hurt someone

A hash-chained record of what is on each machine, what was verified, and when.

CRA Article 14 gives you 24 hours to file after an actively exploited vulnerability. Machinery Regulation Annex III 1.1.9 requires you to identify safety-relevant software and record evidence of intervention. Neither is satisfiable from a spreadsheet. This is built from the record instead.

A change or advisory just landed — check it free Talk to sales See pricing

Night-shift palletising robot cell behind a safety fence with a cabinet display showing a configuration hash and timestamp.

Vertical view of a palletising cell at night with a hashed local panel and scanner zone marks.

Run it now, inside your plant, nothing uploaded

pip install -e '.[assurance-attest]' python -m assurance kit init plant/ python -m assurance kit check plant/kit.json python -m assurance kit run plant/kit.json --out plant/out

Your ledger, your disk. No account, no API key, no upload. The run arms a guard over the process's socket layer and refuses every outbound connection, including name resolution.

Plant engineer running an air-gapped enrolment kit at an open control cabinet with the network unplugged.

Vertical portrait of a plant engineer with an offline rugged laptop and capped Ethernet at a control cabinet.

Offline enrolment kit

Your ledger, your disk. Nothing leaves the room.

No account, no API key, no upload. kit check lists every file a run would open and touches nothing — the run arms a guard over the process's socket layer and refuses every outbound connection, including name resolution.

Read the kit guide

Offline enrolment kit on a plant laptop with outbound Ethernet ports capped.

KIT.md — the full offline enrolment walkthrough

Compliance desk with a 24-hour clock and an Article 14 early-warning dossier overlooking a European plant.

Reg. (EU) 2024/2847Applies since 11 Sep 2026. An actively exploited vulnerability means 24 hours to file an early warning.

Open safety cabinet with labelled firmware and a printed inventory of safety-relevant software.

Machinery Reg. 2023/1230Applies 20 Jan 2027. The machine must identify its safety-relevant software and record evidence of intervention.

Bound evidence pack with printed hash lines, tamper-evident tape, and a signature card.

Hash-chained evidenceA hash chain catches editing. A counter-signature over the ledger head catches deletion.

Disconnected rugged laptop on a plant desk with a printed list of local kit files.

Offline enrolment kitRuns on the operator’s disk. The socket guard refuses every outbound connection, including DNS.

Start here

Find your proof in one click.

Every answer below is a real terminal capture from this exact codebase — not a mockup.

Overhead of palletising lines with one cell lit and an advisory matched to serial AR-7#0412 on Plant 2 Line 4.

What are you trying to do?

Fleet advisory, matched by hash

One advisory, fanned out to every enrolled serial — confirmed, not guessed.

$ assurance fleet advisory advisory-CTRL-2026-11.json --ledger register.db

CTRL-2026-11 (ControlCo, safety_relevant) — NEEDS REVIEW Grimaldi/AR-7#0412 Plant 2, Line 4 [confirmed] ITM-FW 3.8.2 the artefact on this machine is byte-identical to one ControlCo named as affected (aaaaaaaaaaaa). SF-01 Protective stop on zone intrusion SF-02 Speed limit in collaborative operation provenance: - This advisory is not signed, or its signature was not checked. Ask the supplier to publish a signed feed.

See the full solution →

Start here — free, no account

Machine Assurance Check: a change landed. What does it mean for this machine?

This is the question the whole system exists to answer. Paste a supplier advisory and one machine's manifest below and run the real check — the same match logic that decides whether a hash is byte-identical, a version label is only a label, or the two disagree and neither column gets to claim this machine. An explicit verdict, never collapsed to safe-or-not: no impact found, potentially affected, or needs a human to look.

Machine Assurance Check — try it right here

POST /v1/check/machine — edit the advisory or the manifest

{
  "advisory": {
    "advisory_id": "CTRL-2026-11",
    "issued_by": "ControlCo",
    "issued_at": "2026-09-12T08:00:00Z",
    "title": "Watchdog may not trip under sustained bus load",
    "summary": "The watchdog can fail to trigger the safety-rated stop.",
    "severity": "safety_relevant",
    "affected": [
      {
        "supplier": "ControlCo",
        "name": "Safety controller firmware",
        "versions": ["3.8.0", "3.8.1", "3.8.2"],
        "content_hashes": ["1111111111111111111111111111111111111111111111111111111111111111"]
      }
    ],
    "remedy": "Update to 3.9.0 and re-run the stop-performance test.",
    "reference": "https://controlco.example/advisories/CTRL-2026-11",
    "fixed_versions": ["3.9.0"]
  },
  "manifest": {
    "manifest_id": "MAN-0412",
    "machine": { "manufacturer": "Grimaldi", "model": "AR-7", "serial": "0412", "site": "Plant 2, Line 4" },
    "source": "as_found",
    "taken_at": "2026-09-01T00:00:00Z",
    "taken_by": { "identifier": "a.integrator", "role": "safety engineer" },
    "items": [
      {
        "item_id": "ITM-FW",
        "kind": "firmware",
        "name": "Safety controller firmware",
        "version": "3.8.2",
        "content_hash": "1111111111111111111111111111111111111111111111111111111111111111",
        "hash_source": "read_from_machine",
        "supplier": "ControlCo",
        "implements": ["SF-01", "SF-02"]
      }
    ],
    "functions": [
      { "function_id": "SF-01", "description": "Protective stop on zone intrusion", "required_performance": "PL d", "verified_by": ["ssm_separation", "stop_characterisation"] },
      { "function_id": "SF-02", "description": "Speed limit in collaborative operation", "required_performance": "PL d", "verified_by": ["speed_limit"] }
    ],
    "method": "read via controller service port"
  }
}

Result

This endpoint is not hosted publicly yet — click Run to see exactly what that means and how to run it yourself.

This calls the real POST /v1/check/machine endpoint on one machine, free, no account. Enrolling the machine unlocks POST /v1/check/fleet-machine: the same check joined to its intervention history, its evidence staleness, and the fleet-wide fan-out across every other enrolled machine — the Cell plan.

Explore products

Plans, engines, and the API, in one place.

Every row below maps to code that runs. Nothing on this page is listed that the software does not do. Engine tiles link to the buyer-facing guide for that engine; plan tiles link to pricing.

The free CRA Article 14 validator — try it right here

POST /v1/spec/validate — edit the payload

Response

FastAPI surface for billing and entitlements. `GET /v1/plans` returns the pricing table generated from the entitlements the software enforces. Self-host with uvicorn today.

View source

Solutions

Built for the people who sign, verify, or get blamed.

Five buyers, five reasons the paperwork stopped describing the machine.

Manufacturer

Your Declaration of Conformity is only true the day you sign it.

You shipped a machine with a Declaration of Conformity, a risk assessment, and a CE mark. Every firmware patch, scanner re-zone, or PLC change since then is a day that Declaration has been quietly less true — and nothing in your process says so.

See the manufacturer page Plant operator

You did not change the firmware. You will still be asked to explain what did.

A safety controller update, a re-zoned scanner, a PLC project patch — often pushed by an integrator or a remote service call you were not in the room for. When something goes wrong, the plant is where the questions land first.

See the plant operator page Compliance officer

The 24-hour clock does not pause for a spreadsheet.

CRA Article 14 gives you 24 hours from awareness of an actively exploited vulnerability to file an early warning naming every Member State where the product is available. Getting the clock right, the reasoning right, and the field-5 territory list right, under that pressure, is not a spreadsheet problem.

See the compliance officer page Insurer / auditor

You should never need an account to verify a claim.

A manufacturer hands you a Declaration of Conformity, an attestation, or a safety verification bundle. Your job is to check whether it is real, current, and internally consistent — and you should not need to buy anything to do it.

See the insurer / auditor page AI / ops platform team

The assurance product sits on a real integration layer — not a demo.

NeuralBridge is the FastAPI backend, MCP gateway, and connection model the assurance product is built on. If your team is exposing tools to AI agents or wiring up connection state, this is the layer underneath, not a separate pitch.

See the ai / ops platform team page

Pricing

Three tiers. Verification is free at every one, always.

Assurance tiers are computed from the weakest input, never passed in. If it is not gated in code, it is not on this page — GET /v1/plans returns this same table, generated from the entitlements the software enforces.

Three objects on a bench representing Validator, Register, and Cell plans.

Which tier fits? Tick what you need.

Do you need to keep an Article 14 register?Yes — open and track Article 14 cases with both deadline clocks and an exportable ledger

Do you also need any of these?Machine safety verification (ISO/TS 15066 checks against a safety envelope)Machinery Annex III manifests and passportsFleet advisory fan-out across enrolled machinesChange-assurance cases (open, claim, re-verify, close over /v1/change/*)Counter-signed head attestation

RegisterRegister keeps the Article 14 register for one manufacturer: both deadline clocks and a hash-chained ledger with verifiable export. Cases are not metered — no per-case cap or charge.

See Register pricing Talk to sales

Derived from which capabilities each plan gates in src/assurance/billing/plans.py (see docs/claims-registry.md): the register on Register and Cell; machine verification, Annex III, fleet advisory, change-assurance cases and attestation on Cell only. There is no volume to size — cases are not metered. Prices are launch hypotheses, not validated with paying customers.

Validator

Free

Check a draft Article 14 filing against the ENISA platform's 39-field specification before you open the platform. No account, nothing recorded.

/ai control plane: discover the demo connection and run READ operations (list tables, describe a table, run a SELECT), up to 30 a day — writes need Register or Cell
POST /v1/spec/validate — what is missing, what exceeds a character limit, which listed territories are not EU Member States
GET /v1/spec/fields — the full field specification per track and stage
POST /v1/machine/separation — the ISO/TS 15066 protective separation distance for your cell, term by term, from your own stop figures
POST /v1/machine/bundle/check — re-verify anybody's evidence bundle. Always free: a bundle only a paying customer can check is worth nothing
POST /v1/machinery/diff — whether a machine still matches the configuration it was CE-marked with
POST /v1/fleet/advisory/check — whether one supplier advisory affects one machine
POST /v1/fleet/declaration/check — whether a Declaration of Conformity still describes the machine you were sold. Always free: the person who most needs this is the buyer, not the seller

Get the quickstart

€390 / month

The Article 14 register for one manufacturer: awareness records, both deadline clocks, triage with the grounds cited, and a hash-chained evidence ledger you can export.

Everything in Validator, without the daily cap
Cases are not metered — no per-case cap or charge
Awareness records with the reasoning that defends them
Both final-report clocks computed correctly, and the platform's counter defect surfaced rather than inherited
Hash-chained evidence ledger; export refuses if the chain does not verify
/ai control plane: unlimited reads, propose-and-approve WRITEs, bind additional connections, the adapter-call log for your account (held in memory, cleared on restart) and durable plan decisions

First 10 minutes: open a real Article 14 case, and unlock /ai’s write path (plan → approve → receipt) — with one key, no live checkout required to try it locally (see docs/buyer-journey.md).

Talk to sales

Cell

€1,290 / month

For a manufacturer or integrator shipping machines: everything in Register, plus machine safety assurance: check a recorded run against the safety envelope you declared, track what safety software is on each machine and who changed it, and know which safety functions still have evidence that describes the machine as it is today.

Everything in Register
/ai control plane: unlimited reads, propose-and-approve WRITEs, bind additional connections, the adapter-call log for your account (held in memory, cleared on restart) and durable plan decisions
Machine safety verification: POST /v1/machine/verify checks a recorded run against a declared safety envelope and seals the result
Separation, speed, workspace, stop characterisation, power-and-force and mode-consistency checks, each with its worst margin
Evidence bundles anyone can re-verify without an account
Machinery Regulation Annex III 1.1.9: the safety software manifest, the intervention record, and the machine passport

First 10 minutes: open a real Article 14 case, and unlock /ai’s write path (plan → approve → receipt) — with one key, no live checkout required to try it locally (see docs/buyer-journey.md).

Talk to sales

There is also a fourth, unlisted tier — Supplier — for component suppliers who want to publish signed advisories to a hosted feed (POST /v1/supplier/advisory). It has no self-serve price yet, sales-assigned only per ADR-0001: get in touch.

Capability	Validator	Register	Cell
Free verification (Declaration, manifest, attestation)	✓	✓	✓
Article 14 draft validation & calculators	✓	✓	✓
Offline enrolment kit	✓	✓	✓
/ai control plane — discover + read (30/day)	✓	✓	✓
/ai control plane — propose-and-approve writes, bind connections, an in-memory audit log for your account	—	✓	✓
Article 14 register (both clocks; cases are not metered)	—	✓	✓
Hash-chained ledger with verifiable export	—	✓	✓
Machine safety verification	—	—	✓
Annex III manifests & passports	—	—	✓
Fleet advisory fan-out	—	—	✓
Change-assurance cases (`/v1/change/*`; closure is a named human decision)	—	—	✓
Counter-signed head attestation	—	—	✓

The plan cards above render live from GET /v1/plans when this page can reach a deployed API, and fall back to this static table (identical data) otherwise — that is the honest state right now: the billing API is real and tested (POST /v1/checkout refuses a payment it cannot provision rather than faking one, and every register route fails closed with no API keys configured), but it is not deployed to a public endpoint. Deploying it needs outbound access to Fly.io from wherever runs fly deploy, plus live Stripe keys — neither is available in the environment that built this page. See the billing routes and the deploy guide for the exact remaining steps.

The prices (€390 and €1,290 a month) are launch hypotheses. They have not been validated with paying customers, and nothing on this page claims otherwise. Watch (the scheduled drift check) runs in your own kit or cron — the hosted API serves cases, it does not run a scheduler for you.

The platform underneath

NeuralBridge: the integration layer the assurance product is built on.

A lightweight integration hub: a FastAPI backend, an MCP gateway for AI tool exposure, a small set of supported adapters, and a dashboard. It is intentionally narrower than it once claimed to be.

Ops desk with an MCP tool list, PostgreSQL and REST gateways, and a small FastAPI server.

Area	Current status
FastAPI backend	Supported
Connection management model	Supported
MCP tool listing / invocation	Supported
Dashboard foundation (separate admin UI, not wired to the assurance API)	Evolving
Basic audit trail (in memory by default; cleared on restart)	Evolving
Small set of working adapters (PostgreSQL, REST)	Supported
Broad adapter ecosystem	Evolving
Full enterprise compliance posture	Evolving

Full detail, including what is not yet claimed, is in the README.

Verify one Declaration for free. See what your paperwork stopped describing.

No account, no upload, no procurement cycle to start. The Validator tier runs on your machine today.

Get the quickstart Talk to sales