# VasperaMesh

> VasperaMesh is the deterministic control plane for regulated AI decisions. Point your existing OpenTelemetry exporter at VasperaMesh — the same line you would send to Datadog — and every AI decision (including tool calls and structured outputs) becomes one immutable row in a hash-chained audit ledger, externally anchored to Bitcoin and verifiable offline without trusting the vendor, governed by a deterministic gate that returns pass, hold, or escalate. Built lending-first for the Fannie Mae LL-2026-04 / Freddie Mac / ECOA era of AI governance.

## What it does

- **OpenTelemetry-native capture (one line).** Point your existing OTLP exporter (the OpenTelemetry GenAI conventions — invoke_agent / chat / execute_tool spans) at VasperaMesh's ingest. No SDK rewrite. Tool calls and generateObject structured outputs — the actual decisions, not just generations — are recorded and gated. A shadow proxy (base-URL change) is also available for non-OTel callers.
- **Tamper-evident audit ledger.** Every agent action (generation, gate verdict, policy change, human override) is one append-only row. Rows are hash-chained (RFC 8785 canonicalization, domain-separated SHA-256), so any later edit breaks the chain.
- **External anchoring.** Chain heads are timestamped via OpenTimestamps and confirmed on the Bitcoin blockchain. Only a 32-byte hash leaves the boundary.
- **Offline, zero-trust verification.** A standalone verifier re-derives every row hash from its canonical fields and cross-checks the Bitcoin anchors — with no login and no trust in VasperaMesh. Anyone can verify a decision at /verify or by downloading the verifier.
- **Plain-English policy gates.** Author an agent "constitution" in natural language; it compiles to a deterministic gate that returns pass / hold / escalate. Enforcement modes: shadow (record only), advisory (verdict returned), enforcing (block on hold/escalate until a human approves).
- **Compliance evidence.** Generate auditor-ready evidence packs mapped to Fannie Mae LL-2026-04 (effective Aug 6, 2026), ECOA / Reg B (15 U.S.C. 1691(d) / 12 CFR 1002.9), EU AI Act (Articles 12, 14, 19), ISO 42001, and NIST AI RMF — every control backed by the cryptographic ledger, not self-attestation. Adverse-action reasons are structural and reproducible, not the LLM explaining itself.
- **Operations.** Ledger search, reasoning-chain traces, incident workflow, alerts, SIEM export (JSON / CEF), RBAC with org invites, and content retention with envelope encryption.

## Who it's for

Teams running AI agents in production that need attributable, tamper-evident decision records: regulated industries first (lending, trading, healthcare, finance) facing EU AI Act enforcement, SR 26-2 / ECOA, FINRA/SEC, and HIPAA audit-trail and retention requirements — plus any AI product team that needs to answer "why did the agent do that?" with proof.

## How it is different

Observability tools (LangSmith, Langfuse, Helicone, Arize, Braintrust) trace agents but store mutable, vendor-trusted logs — they cannot attest without breaking their own model. GRC platforms (Credo AI, Monitaur, ValidMind, Fiddler) document governance but their evidence is self-attested and most lack runtime enforcement. VasperaMesh is the runtime enforcement point that also emits the un-fakeable record: a policy layer and an enforcement point in one product, backed by a hash chain a regulator can verify offline.

## Pricing

- **Free** — 5,000 ledger rows / month, 1 policy.
- **Pro — $99 / month** — 100,000 ledger rows / month, unlimited policies, backtests.
- **Enterprise — custom** — self-hosted / VPC, SSO, WORM anchoring, custom volume.

## Key pages

- Home: https://www.vasperamesh.com/
- Pricing: https://www.vasperamesh.com/pricing
- FAQ: https://www.vasperamesh.com/faq
- Ledger spec (versioned, public): https://www.vasperamesh.com/spec
- Verify a decision (public, no login): https://www.vasperamesh.com/verify
- Docs: https://www.vasperamesh.com/docs

## Getting started

1. Sign up and create an organization.
2. Author a policy in plain English and have a second person approve it (separation of duties is enforced).
3. Mint an API key and point your agent's model base URL at the VasperaMesh gateway.
4. Watch decisions land in the ledger; verify any of them at /verify with no login.