Built for the rules
AI is facing.
New AI regulation keeps coming back to the same questions: can you show what your AI did, keep the record, and control the data behind it? Kraterion is built to give you those technical controls — out of the box, not bolted on.
DPA, subprocessor list, and security docs available on request · security@kraterion.com
- coveredAutomatic, durable logsEU AI Act · met by Run records
- coveredRight to erasureGDPR · met by Revoke + crypto-erase
- coveredTraceabilityISO 42001 · met by Lineage + replay
- coveredData residency & ownershipGDPR · met by You own the bytes
Different rules, three demands.
Strip away the acronyms and most AI regulation asks for the same three things. Kraterion provides each as a property of the system.
Durable audit logs
High-risk AI must automatically record what it did and keep it (6 months minimum). Every Kraterion run is a tamper-evident record you keep as long as you need.
Data control & erasure
People can ask to be forgotten. Because data is encrypted and access is revocable, you can lock it out or erase it by destroying the key — and prove you did.
Traceability & provenance
Frameworks want to reconstruct how a decision was made. Lineage shows every input behind an output; replay reproduces the run against the same data.
The controls regulators ask for —
already in the product.
What it asks. What we give you.
EU AI Act
High-risk AI · obligations apply Aug 2, 2026
What it asks
Automatic event logs over the system's lifetime, kept six months at minimum (Art. 12 / 19). Traceability of inputs to outputs, and technical documentation you can produce on request — retained up to 10 years (Art. 18).
- Run records
- Tamper-evident logs
- Replay
- Lineage
GDPR
Personal data · right to erasure (Art. 17)
What it asks
Lawful control over personal data: restrict access, honor erasure requests, and keep data in a region you choose. EU data-protection authorities accept cryptographic erasure — destroying the key — as valid deletion.
- Encrypted by default
- Revoke access
- Cryptographic erasure
- Owned & portable
ISO 42001 · NIST AI RMF
AI governance frameworks
What it asks
Continuous traceability — a versioned accountability record with input provenance, outputs, approvals, and retention an external reviewer can follow end to end.
- Run records
- Lineage
- Verifiable citations
- You own the logs
Your data, on your terms.
The questions every security review asks — where the data lives, who can read it, how it's deleted, how long it's kept. Here, the answers are properties of the system.
Residency you choose
Your data lives on storage you own and control. Keep it in a region you pick, and move it out anytime with standard tools.
Encrypted, keys you hold
Everything is sealed before it leaves you. The platform stores ciphertext only — we never hold the keys to your data.
Deletion that proves itself
Erase by destroying the key. EU regulators recognize cryptographic erasure, and access is revocable in a single step.
Retention on your terms
You decide how long run records and logs live — no vendor retention cliff, no traces aging out on someone else's clock.
Where we stand today.
What's in place, what's in progress, and what isn't supported yet — stated plainly. We'd rather you know than guess.
Need our DPA, subprocessor list, or a security review? security@kraterion.com — documentation is available on request.
Teams that have to show their work.
Financial services
Agents that touch advice, underwriting, or trading — where every decision needs a defensible record.
Healthcare & life sciences
Sensitive data with strict access, residency, and deletion requirements.
Public sector
Procurement and citizen-facing AI that must be transparent and auditable by design.
Anyone shipping high-risk AI
If your agent influences real decisions, you'll be asked to show your work.
Controls, not a checkbox.
Kraterion gives you the technical controls these rules call for — durable logs, encryption, revocable access, replay, and lineage. It doesn't make you compliant on its own, and nothing here is legal advice. Your compliance program is yours; we make the evidence easy to produce.
Ship AI you can
stand behind in an audit.
Durable audit trails. Data you own and can erase. Runs you can replay.