Documentation

The whole product, written down

Every guide CarveTrace ships, organized by what you're trying to do. The canonical source is the GitHub repository ; this page is the index. Specs and references are versioned with the code — open the GitHub link to see the exact text against a tagged release.

See the demo Talk to us

Get oriented

Start here if you have ten minutes and want to understand what CarveTrace is.

What CarveTrace proves

The properties our evidence guarantees, in plain language.

Architecture

How the pieces fit together : SDK, chain, TSA, verifier.

Threat model

What we defend against and what we explicitly don't.

Capabilities inventory

A flat list of what the product does today, per module.

AI Act mapping

How CarveTrace evidence maps to specific EU AI Act articles and ISO 42001 controls.

AI Act events overview

The events CarveTrace ships and which AI Act obligation each addresses.

Article 12 mapping (record-keeping)

Article 12 subsections → CarveTrace events → verifier checks.

Article 12.2(a) — operator identification

How operator-session integrity is established and proved.

Article 12.2(c) + 12.4 — biometric matching

Biometric input data + match-traceability evidence.

Article 12.3 — retention

Retention policy declaration, enforcement, and proof.

Annex IV supplement

The signed, schema-versioned reporting-period summary package.

ISO 42001 mapping

CarveTrace evidence → ISO/IEC 42001:2023 controls.

Build with CarveTrace

For engineers integrating the SDK or operating the platform.

AI evidence guide

End-to-end walkthrough : instrument, sign, verify.

CLI reference

Every carvetrace subcommand with flags and examples.

Protocol reference

The wire formats, schema hashes, and canonical encodings.

SDK feature matrix

What every SDK + adapter combination supports.

Cloud deployment guide

AWS / GCP / Azure / OVHcloud deployment patterns.

Auth deployment guide

OIDC / SAML SSO setup, reverse-proxy auth, RBAC.

Operate and verify

For SREs, compliance officers, and auditors using the product day-to-day.

Evidence report guide

Generate, customize, and interpret the coverage report.

Verifier guide

How to verify a bundle locally, in browser, or via CLI.

Cross-implementation harness

How Java ↔ WASM ↔ Python verdict parity is proven in CI.

Tamper report guide

What a failed verification looks like and how to read it.

Integrity checking

Continuous chain-integrity validation in production.

TSA anchoring guide

How RFC 3161 anchoring works and which TSAs to use.

TSA cadence configuration

Tuning anchor frequency to your retention + cost profile.

QTSP selection

Picking an eIDAS-qualified Trusted Service Provider.

Anchor publisher guide

Publishing chain anchors via OpenTimestamps and Bitcoin.

Compliance officer workflow

Day-in-the-life walkthrough for a CCO using CarveTrace.

Multiparty verification guide

Independent verification by auditor + regulator + customer.

Security + posture

For security review and procurement due diligence.

Security overview

Crypto choices, supply chain, ops posture.

Security known limitations

Honest accounting of what is and isn't mitigated today.

Timestamping model

The trust + threat model behind RFC 3161 + OpenTimestamps.

Threat model

Adversaries we defend against ; what we explicitly don't.

Security page on this site

Public-facing security posture summary.

on this site →

Don't see what you need?

Drop us a line at contact@carvetrace.com with what you're trying to evaluate. If the answer is in our docs and just isn't surfaced here, we'll add it. If it isn't, we'll write the doc and ship it.