Proof & Compliance

Compliance as a byproduct of running the work.

The platform leaves its evidence behind as it runs; there is no separate evidence-assembly step.

Masking

Private data never reaches the model. Watch it happen.

One request, end to end: the name is tokenized on your soil, only tokens cross the trust boundary, and what comes back is made whole again on your servers.

On your soil

The message arrives raw

Draft the intro for Vera Lindt at Nordbank

PII detected and masked, host-side

Draft the intro for [NAME-9f2c41] at [ORG-77be03]

token ⇄ value map · in memory only, this request only

Rehydrated at display, on your servers

“Hi Vera, following up on Nordbank…”

The ledger row seals the turn

masked: 2 · NAME, ORG · sha256 a91f…c2

counts, categories and value hashes · raw PII is unrepresentable in the row schema

The map dies with the request

[NAME-9f2c41] ⇄ Vera Lindt

dropped right after use · nothing durable can reverse the tokens

The AI provider

Only masked text crosses

…intro for [NAME-9f2c41]…

retrieval, when on, also runs on the masked text

The model answers in tokens

“Hi [NAME-9f2c41], following up on…”

it never held the name

No new PII store is ever created. The token map is not a database you have to defend: it lives in memory for the life of one request and is dropped right after use. There is nothing durable to breach, subpoena, or leak.

Every lane is masked

Connector reads, retrieval, tool inputs and tool outputs all pass the same masking gate as chat before any model sees them. An unknown category fails closed, to masked.

Schema masking, per connector and document

For structured data you can go further: a deterministic masking schema per connector or document type says exactly which fields tokenize. Every declared field tokenizes the same way every time; anything undeclared is masked.

The receipt

Every job ends in a verified receipt.

A receipt you can check, item by item: the masking count, the human approval, rehydration on-soil, the sealed ledger event, the metered cost.

Masked before any model

The count of items protected, and the plain fact that raw personal data never reached the provider.

Approved, then rehydrated

A person said yes where it mattered; real names were restored only after, only on your servers.

Sealed and metered

A signed event in the append-only ledger, and the per-job cost as metered.

ZeroH · Job Receiptsample data

APPROVED · SENT

Send intro mail · Jonas W

“Hi Jonas, following our call with Vera Lindt, here is the proposal for Nordbank.”

Rehydrated at the gate; the mail left with real names.
A rejected hold NEVER rehydrates.

ZeroH Governed ✓ VERIFIED

Private data was masked before any AI saw it14 items protected · raw personal data reached the model: no
A person said yes before anything went outapproved by J. Weiss · the send waited 41 minutes for the decision
Real names were restored only after the yeson your servers · the AI provider never saw them
Sealed in the tamper-evident recordreceipt № 2481 · 17 Jul 2026, 12:41 · signed by your organization

Meets your frameworks

ISO 42001ISO 27001GDPRSOC 2AICM

$0.09what this run cost · metered, never estimated budget checked before it ran

Details for your auditor ↗

The law, traced to running code

From the clause to the module that enforces it.

Every governed turn, tool call and decision lands on the append-only ledger; click any row to open the signed receipt it left behind.

sample events, illustrative · your console reports its own live, hash-chained ledger

Events

18 of 18 in range

Time	Agent	Kind	Source	Categories	Masked	Policy
2026-07-16T09:02Z	Sales Agent	`Governed turn`	Teams	`PERSONORGFIN-AMOUNT`+1	14/14	v7
2026-07-16T08:57Z	Compliance Agent	`Policy change`	Console	-	-	v7
2026-07-16T08:41Z	Finance Agent	`Approvals`	Console	`FIN-AMOUNT`	3/3	v7
2026-07-16T07:31Z	Chief of Staff	`Governed turn`	Web chat	`PERSONEMAILPHONE`	22/22	v7
2026-07-16T06:14Z	Marketing Agent	`Governed turn`	SharePoint	-	-	v7
2026-07-15T18:22Z	Ask Ali	`Governed turn`	Web chat	-	-	v7
2026-07-15T16:44Z	HR Agent	`Governed turn`	Word	`PERSONEMAILPHONE`+1	31/31	v7
2026-07-15T15:10Z	Operations Agent	`Tool call`	CRM	`PERSONEMAIL`	6/6	v7
2026-07-15T14:03Z	Compliance Agent	`Governed turn`	Console	-	-	v7
2026-07-15T11:30Z	Project Manager	`Governed turn`	Teams	`PERSON`	7/7	v7
2026-07-15T09:05Z	Help Desk	`Governed turn`	Teams	-	-	v7
2026-07-14T17:20Z	Finance Agent	`Governed turn`	Word	`IBANFIN-AMOUNTORG`	18/18	v7
2026-07-14T12:02Z	Sales Agent	`Tool call`	Outlook	`EMAILPERSON`	4/4	v7
2026-07-14T10:41Z	Compliance Agent	`Tool call`	Console	-	-	v7
2026-07-14T09:12Z	Operations Agent	`Governed turn`	Teams	`PERSON`	7/7	v6
2026-07-13T16:40Z	Compliance Agent	`Policy change`	Console	-	-	v6
2026-07-13T10:15Z	HR Agent	`Approvals`	Console	`EMAILPHONE`	2/2	v6
2026-07-12T08:30Z	Marketing Agent	`Governed turn`	SharePoint	`PERSONORG`	5/5	v6

append-only · hash-chained · ES256 signed

Framework readiness

Mapped to the frameworks your auditor already knows.

Trace it yourself: pick a law set, then click any law, control, module or proof to light its whole chain across all four columns, both ways.

Trace the framework

Click any node: its whole chain lights across all four columns, both ways.

Show laws:

Nothing selected: click a law, control, module, or proof to trace its chain.

DSPLOGSEFGRC

The Law the why

PDPPL · Art 5 - Data minimisation

PDPPL · Art 8 - DPIA (high-risk)

PDPPL · Art 15 - Cross-border

QFC · Reg 10 - Cross-border

NDPO / NCSA - Breach notification

The Controls AICM · must-dos

DSP-10 Sensitive Data Transfer

DSP-17 Sensitive Data Protection

DSP-22 Privacy Enhancing Technologies

LOG-04 Audit Logs Access and Accountability

SEF-07 Security Breach Notification

GRC-10 AI Impact Assessment

The Modules what ZeroH builds

Mask the question

Fetch as the user

Re-check the answer

Hand over proof

Proof packs

Incident reports

Operator oversight

Govern the tool actiontool-allowedinput-maskedoutput-maskedtool-blockedtool-approved

Emit-Proof the receipt

◐ Masking receipt

✓ Signed event

▣ Redaction receipt

◷ Meeting-prep receipt

⚙ Tool-call audit

☑ Tool approval

📦 Proof pack

Proof packs, built with regulators

A focused pack, shaped to the framework that asked.

A regulator does not want a data dump. Pick an agent and a framework and assemble the pack a supervisor actually reads: the system card, the controls trace, the signed event extract, the masking summary. Every claim in it cites a signed event.

Agent

Regulator / framework

Pick a scope and a framework, then assemble the pack. The preview is illustrative; a live console builds it from the signed ledger.

The registers a supervisor reads

We work the way regulators read.

A supervisor should not wade through raw logs. They get the registry, the risks, and the packs, each row backed by the ledger. Here are the systems we run and the risks we carry, stated plainly.

AI System Registry

The ten agents as registered AI systems: purpose, model routing, data classes, and the human gate.

AI System Registry
System	Purpose	Model routing	Data classes	Human gate	Status
Marketing Agentsys-mkt-01	Drafts campaigns and posts from approved brand and field sources.	policy-routed: claude-sonnet-5 for long-form, claude-haiku-4.5 default	Public / brand · occasional PERSON, ORG	Outbound publishing held for approval	active
Sales Agentsys-sales-01	Researches accounts and drafts outreach before first touch.	policy-routed: claude-sonnet-5 for research, zeroh-ft-3 for alerts	PERSON, ORG, EMAIL, FIN-AMOUNT	Outbound mail held for approval	active
Finance Agentsys-fin-01	Reads spend, flags anomalies, drafts variance notes.	policy-routed: claude-haiku-4.5 default, claude-sonnet-5 for narrative	FIN-AMOUNT, IBAN, ORG	Session unmask + posting held for DPO	active
HR Agentsys-hr-01	Screens candidates blind and drafts people documents.	policy-routed: claude-sonnet-5 for scoring, claude-haiku-4.5 default	PERSON, EMAIL, PHONE, LOCATION	Unmask + decisions held for People Partner	active
Operations Agentsys-ops-01	Keeps CRM clean, captures decisions, preps reviews.	policy-routed: claude-haiku-4.5 default	PERSON, EMAIL, ORG	CRM writes card-approved	active
Compliance Agentsys-cmp-01	Assembles proof packs, watches policy, answers the GRC desk.	policy-routed: zeroh-ft-3 for packs, claude-sonnet-5 for consult	Governance metadata · no raw PII	Policy writes versioned, DPO-approved	active
Help Desksys-help-01	Answers handbook and IT questions, grounded on approved corpora.	policy-routed: zeroh-ft-3 default	Handbook / policy · minimal PERSON	Escalations handed to a human	active
Project Managersys-pm-01	Tracks programs, drafts status, surfaces blockers and owners.	policy-routed: claude-haiku-4.5 default	PERSON, ORG · project metadata	Status posts reviewed before send	active
Chief of Staffsys-cos-01	Runs morning digests and cross-team synthesis for the executive.	policy-routed: zeroh-ft-3 for digests, claude-sonnet-5 for synthesis	PERSON, EMAIL, PHONE · cross-team	Sensitive summaries held for the sponsor	active
Ask Alisys-ali-01	Grounds Shariah and compliance answers on the governed corpus.	policy-routed: zeroh-ft-3 default, claude-sonnet-5 for long-form	Doctrine / citations · no personal data	Rulings cite sources; disputes escalate	onboarding

every row in the register cites its ledger evidence

Risk Registry

An honest AI risk register: the two that matter most first, each mitigation backed by a signed event.

Risk Registry
Risk	Likelihood	Impact	Mitigation	Evidence
AI concentration	High	High	Over-relying on one model or provider is itself a risk. Policy routing spreads jobs across models and providers (claude-haiku-4.5, claude-sonnet-5, gpt-5.4-mini and the tuned zeroh-ft-3), with per-job model economics and no single-model dependency.	Model routing summary · the leaderboard models line · per-turn model on every receipt
PII shared with AI	High	High	Masking runs on-soil before any model call, so raw personal data never reaches a provider. PII reaches a model only with your explicit approval: session-unmask grants and human gates.	Masking summary · the per-turn masked-before-model receipt · session-unmask approvals record
Hallucination / ungrounded output	Medium	Medium	Retrieval grounding, refuse-over-guess, and a quality bar the turn must clear before it lands.	Grounded turns cite sources · refusals are their own sealed events
Prompt injection	Medium	High	Governed tools only, tool allowlists, and an SSRF guard on any web fetch.	Blocked tool calls on the ledger · the gate-refusal control on the receipt
Data residency	Low	High	On-soil masking and rehydration, per-tenant deployment; rehydration maps live in memory only.	On-soil deployment attestation · the rehydration proofline on every turn
Runaway cost	Medium	Medium	Soft budgets, per-job metering, and day pools that cap public-desk spend.	Per-job actual cost on every receipt · the spend KPI on the board
Model drift	Medium	Medium	Eval gates and ratified improvements: a change ships only past the gate.	Eval-loop runs · the skill-promotion events on the ledger
Vendor lock-in	Low	Medium	Multi-provider routing keeps the work portable across models and providers.	Model routing summary · the multi-provider spread on the board

every row in the register cites its ledger evidence

The regulatory bundle: Qatar / QCB

Built for the regulator that will ask.

The QCB AI guideline mapped clause-by-clause, with proof packs generated from the live ledger, the kind a regulated bank can file.

Mapped clause-by-clause

The Qatar Central Bank AI guideline traced to controls and the modules that enforce them.

Quarterly proof pack, filed

Regulator-grade, generated from the live ledger, in ISO 42001 / QCB pack formats.

The rulebook tiles

The specific clauses the platform answers to, each backed by a receipt.

QCB-AI-01

Every AI output traceable to a signed record

QCB-AI-04

Human approval before external effect

QCB-AI-07

Model inputs stripped of personal identifiers

Questions we hear

Asked before every pilot.

Does the AI provider ever see our personal data?

No. Personal data is masked on your own infrastructure before any model is called: names become reversible placeholders, only the placeholders cross the trust boundary, and the restoration happens back on your servers. An unknown category fails closed, to masked.

What evidence do we get that a job ran the way you claim?

Every turn lands on an append-only, hash-chained audit ledger, and every job ends in a receipt you can check: the masking count, the human approval, rehydration on your soil, the sealed ledger event and the metered cost. An action that cannot be recorded is refused rather than reported as done.

How does this map to the frameworks our auditors ask about?

Proof packs assemble the ledger evidence into framework-shaped exports: ISO 42001, ISO 27001, SOC 2, GDPR and EU AI Act style evidence, produced by normal use rather than by a compliance project.

Where does our data actually live?

On the boundary you choose. On our fleet, your tenant is isolated and your data never mixes with another customer's. On your own Azure subscription, nothing leaves your boundary at all: your Key Vault, your storage, your network, and an audit ledger signed with a key you hold.

Ask the GRC desk about any of this, live.

The Governance, Risk & Compliance desk answers governed, on-soil, right on the homepage.

Ask the GRC desk Book the demo