For security, risk & compliance

Regulators are already asking. Can you prove it?

Every decision sealed in a tamper-evident record — self-host and none of it leaves your perimeter. Reproduce any incident. Gate every release.

If an autonomous system moves money, changes infrastructure, approves a customer, or writes production code — can you prove what it did?

Book a security review →Procurement kit →

Maps toAPRA CPS 230EU AI Act Art. 12NIST AI RMFall frameworks →

support-agent · refund · blocked at gateclick any step ↓

Policy gate · issue_refund — blocked

amount: $250
rule: no_refund_over_100

blocked call

issue_refund({ amount: 250, customer_id: 8842 })

Gate blocked this: a $250 refund on a disputed charge breaks two policies. Caught before it reached the customer.

Incident

Agent runs

3 days

Customer complaint

Logs only — can't prove

Without a reproducible record, you can't demonstrate control of your own system.

Audit

Auditor“Show me every agent decision, last 90 days. Tamper-evident.”

✗Log lines don't qualify

✓Runback — sealed, verifiable export

Board

EU AI Act

“Are our AI systems in scope? Do we have compliant logs?”

Most enterprises have no honest answer today.

The cost of doing nothing

The exposure is already on your books.

AI agents in production20Incidents needing investigation / year12Hours to investigate one today16Hours you'd expect with a reproducible run4Engineers pulled into each one3Blended engineer cost / hour$120

$69,120

/ year investigating incidents the slow way

$17,280

on your own estimate above

$51,840

recovered per year — before a single failed audit

Every figure here is arithmetic on the numbers you set, including how long you'd expect an investigation to take with a reproducible run — we have no customer data to average and we haven't substituted a guess of our own. Engineering time only: it doesn't price the exposure of an agent decision you can't reproduce for a regulator, the line item that doesn't show up until it's a finding.

Why existing tools don't cover you

A log tells you what happened. It can't tell you why.

A dashboard built for deterministic software can tell you a call was made; it can't re-derive the reasoning, because the context was never captured as a re-executable unit.

Four failure classes matter in regulated production — none visible in a log, all visible in a replay:

Policy violationContext contaminationPrompt injectionModel drift

See the exact scenario →

141,006runs swept, by hand

3incidents found

Not hypothetical: in July 2026, Anthropic needed a retrospective sweep of cybersecurity-evaluation runs to find three incidents where a misconfiguration let Claude reach live infrastructure. Anthropic's writeup → That's the cost of an instrumentation gap at scale — a six-figure manual sweep, not a query.

Row by row, against what you already have.

Swipe to see all columns →

DIY logging

LangSmith · Langfuse

Runback

Read the full trace after the fact

partial

✓

Built-in evals & datasets

✗

✓

Re-execute the exact captured step

✗

✓

Signed, tamper-evident audit export

✗

✓

Self-host · data never leaves your perimeter

✓

partial

✓

Maps to regulated controls (CPS 230 · EU AI Act)

partial

✓

Verified September 2026 — reviewed quarterly.

How it works

One record. From decision to proof.

01 · Observe

failedloan-approval-agent

6 steps · 1,030 tok · gpt-4o

↳ PII: 2 fields redacted in-process

Every model call — context, tools, tokens — captured at the boundary.

02 · Replay

gpt-4o→ escalate(dispute)pass

llama-3.3→ issue_refund(250)regression

Re-run from exact context. Different output = behaviour changed.

03 · Gate

issue_refund({ amount: 250 })

✗ BLOCKED · no_refund_over_100

sealed · seq: 4 · hash: 09c4…

Policy check fires before the call. Block sealed into the record.

04 · Audit

$schemarunback.cassette/v1

entries6 · chained

algooracle-chain/sha256

sig✓ verified

SHA-256 chained, Ed25519-signed. Verify without a Runback account.

Architecture

Where Runback sits in your stack.

One SDK wrap. Your existing systems untouched. Your data never leaves your perimeter.

Model ProviderOpenAI · Anthropic · Azure · on-prem

Your Tools & Systemscore banking · CRM · credit bureau · case management

↓

API & tool calls

Your org · your VPC · your infrastructure

Your Agent Applications+ Runback SDK

Loan Agentissue_approval

Fraud Agentflag_transaction

Compliance Agentcheck_policy

3 lines · post-hook only · real model calls run untouched · ~0.16ms added, measured

↓

PII stripped in-processasync · non-blocking

Your Postgresruns · spans · policies · audit trail · your encryption keys · your retention rules

↓

reads only · Runback never writes to your data

Runback Platformself-hosted in your VPC

ObserveReplayGateAuditEvalsGolden

↓

secure access · role-scoped

Risk & Eng Teamsdebug · replay · root cause

CI / Release Gateeval suite · regression block

Auditors & Regulatorscassette export · verify offline · scoped read-only grant, no login

Enterprise: fully self-hosted — Runback platform runs in your cloud, data never leaves your perimeter · Cloud: Runback-managed, PII stripped before ingest, encrypted in transit

Your traces. Your keys. Your building.

Self-host in your VPC

A Next.js app + Postgres. Traces never touch our servers.

Redact before egress

Keys, emails, card numbers, SSNs — scrubbed inside your process.

You own the store

You set retention and access. Delete a run — it's gone.

Open format

SDK + OTel, documented schema. Export and keep your history.

Swipe to see all columns →

Tier	Where traces go	EU / AU residency	DPA
Community (self-hosted)	Your Postgres, your infra	✓ your region	n/a
Starter · Growth · Scale · Pro	Runback cloud (US)	Enterprise only	On request
Enterprise (self-hosted)	Your Postgres in your VPC	✓ your region	Included

Policy gates fail open by default — your agent is never blocked by an outage. Enterprise can configure fail-closed. A failed trace send retries in-process on the next flush; that buffer isn't persisted, so events not yet flushed are lost if the process exits first.

Self-host the source →Free Community edition, container-based, deploys in your own VPC — the setup guide ships in the repo.

Where Runback fits

You probably already have some of these. That's not overlap.

Cloud posture tools, guardrail filters, and SIEM platforms are all real — most security teams run more than one. None capture a specific agent decision, enforce your own rules before it executes, or seal it into a signed record. That's the layer Runback adds underneath whatever you already run.

Cloud security posture (CNAPP)

Scores cloud resources and model endpoints against config rules. Doesn't see: what a specific agent decided on a specific call.

LLM observability & tracing

Captures traces so you can read what an agent did after the fact. Doesn't see: traces are read-only — no re-execution, no tamper-evident export. /vs →

AI guardrail / content moderation

Blocks unsafe input/output in real time. Doesn't see: your business logic — "never refund over $100" isn't unsafe content.

SIEM / log aggregation

Ingests logs everywhere for search and correlation. Doesn't see: an agent decision as more than a log line — nothing re-executable to replay.

Proof / notarization-only services

Hashes and signs a payload to prove it existed unchanged. Doesn't see: anything upstream — no captured context, no rule enforced beforehand.

Inter-agent trust fabric

Every delegation is signed. The chain is provable.

The gap

Orchestrator

delegates to ↓no cryptographic proof

Subagent

Scope can be widened in transit. No proof of who called or what was permitted.

With Runback

Orchestrator

Ed25519-signed token ↓scope: read:customer

Subagent

Every delegation edge sealed. Chain exports as a verifiable artifact.

Trust chain · runback:trust-chain:v2✓ verified

Same signing primitive as the per-run audit record above — Ed25519 where a keypair is configured, HMAC-SHA256 fallback without one. (The separate org-wide ledger checkpoint uses HMAC plus independent RFC 3161 timestamping — see Security.)

loan-orchestratordepth 0a3f8c2d1…b9e4

delegates · scope: *

kyc-subagentdepth 17b2e9f4a…c1d8

delegates · scope: read:customer

credit-check-agentdepth 24d1c8b3e…f2a9

POST to /api/trust/verify — no account required.

Regulatory coverage

The evidence your controls require.

APRA CPS 230

Operational risk & incident management

✓ Incident capture + sealed record
✓ Reproducible audit trail
✓ Continuous monitoring data

EU AI Act

Art. 12 · Logging & traceability

✓ Tamper-evident decision log
~ Human oversight record — captured where an approval gate is used; a reviewer step outside Runback isn't in our record (detail →)
✓ Verifiable export for regulators

NIST AI RMF

Govern · Map · Measure · Manage

✓ Policy simulation against real data
✓ Behavioral drift detection
✓ Defensible decision record

Runback's regulatory mapping, computed from live run data: EU AI Act, ISO/IEC 42001, NIST AI RMF, APRA CPS 230, GDPR, ISO 27001 and APRA CPS 234, each with compliant, partial and gap counts and a downloadable evidence package.

EnterpriseSeven frameworks mapped to Runback capabilities — the three above, plus ISO/IEC 42001, GDPR, ISO 27001, and APRA CPS 234 (full list →). Status is computed live from your run data, not a static crosswalk — any control's evidence can be explained in plain English on demand, and that explanation is itself sealed.Ask us about this mapping →

Regulators are already asking. Can you prove it?

The exposure is already on your books.

A log tells you what happened. It can't tell you why.

Row by row, against what you already have.

One record. From decision to proof.

Where Runback sits in your stack.

Your traces. Your keys. Your building.

You probably already have some of these. That's not overlap.

Every delegation is signed. The chain is provable.

The evidence your controls require.

Deploy AI agents with proof of control — not just proof of deployment.