Evidence infrastructure for machines whose software can hurt someone

A hash-chained record of what is on each machine, what was verified, and when.

CRA Article 14 gives you 24 hours to file after an actively exploited vulnerability. Machinery Regulation Annex III 1.1.9 requires you to identify safety-relevant software and record evidence of intervention. Neither is satisfiable from a spreadsheet. This is built from the record instead.

A change or advisory just landed — check it free Talk to sales See pricing

Night-shift palletising robot cell behind a safety fence with a cabinet display showing a configuration hash and timestamp.

Vertical view of a palletising cell at night with a hashed local panel and scanner zone marks.

Run it now, inside your plant, nothing uploaded

pip install -e '.[assurance-attest]' python -m assurance kit init plant/ python -m assurance kit check plant/kit.json python -m assurance kit run plant/kit.json --out plant/out

Your ledger, your disk. No account, no API key, no upload. The run arms a guard over the process's socket layer and refuses every outbound connection, including name resolution.

Plant engineer running an air-gapped enrolment kit at an open control cabinet with the network unplugged.

Vertical portrait of a plant engineer with an offline rugged laptop and capped Ethernet at a control cabinet.

Offline enrolment kit

Your ledger, your disk. Nothing leaves the room.

No account, no API key, no upload. kit check lists every file a run would open and touches nothing — the run arms a guard over the process's socket layer and refuses every outbound connection, including name resolution.

Read the kit guide

Offline enrolment kit on a plant laptop with outbound Ethernet ports capped.

KIT.md — the full offline enrolment walkthrough

Compliance desk with a 24-hour clock and an Article 14 early-warning dossier overlooking a European plant.

Reg. (EU) 2024/2847Applies since 11 Sep 2026. An actively exploited vulnerability means 24 hours to file an early warning.

Open safety cabinet with labelled firmware and a printed inventory of safety-relevant software.

Machinery Reg. 2023/1230Applies 20 Jan 2027. The machine must identify its safety-relevant software and record evidence of intervention.

Bound evidence pack with printed hash lines, tamper-evident tape, and a signature card.

Hash-chained evidenceA hash chain catches editing. A counter-signature over the ledger head catches deletion.

Disconnected rugged laptop on a plant desk with a printed list of local kit files.

Offline enrolment kitRuns on the operator’s disk. The socket guard refuses every outbound connection, including DNS.

Start here

Find your proof in one click.

Every answer below is a real terminal capture from this exact codebase — not a mockup.

Overhead of palletising lines with one cell lit and an advisory matched to serial AR-7#0412 on Plant 2 Line 4.

What are you trying to do?

Fleet advisory, matched by hash

One advisory, fanned out to every enrolled serial — confirmed, not guessed.

$ assurance fleet advisory advisory-CTRL-2026-11.json --ledger register.db

CTRL-2026-11 (ControlCo, safety_relevant) — NEEDS REVIEW Grimaldi/AR-7#0412 Plant 2, Line 4 [confirmed] ITM-FW 3.8.2 the artefact on this machine is byte-identical to one ControlCo named as affected (aaaaaaaaaaaa). SF-01 Protective stop on zone intrusion SF-02 Speed limit in collaborative operation provenance: - This advisory is not signed, or its signature was not checked. Ask the supplier to publish a signed feed.

See the full solution →

Start here — free, no account

Machine Assurance Check: a change landed. What does it mean for this machine?

This is the question the whole system exists to answer. Paste a supplier advisory and one machine's manifest below and run the real check — the same match logic that decides whether a hash is byte-identical, a version label is only a label, or the two disagree and neither column gets to claim this machine. An explicit verdict, never collapsed to safe-or-not: no impact found, potentially affected, or needs a human to look.

Machine Assurance Check — try it right here

POST /v1/check/machine — edit the advisory or the manifest

{
  "advisory": {
    "advisory_id": "CTRL-2026-11",
    "issued_by": "ControlCo",
    "issued_at": "2026-09-12T08:00:00Z",
    "title": "Watchdog may not trip under sustained bus load",
    "summary": "The watchdog can fail to trigger the safety-rated stop.",
    "severity": "safety_relevant",
    "affected": [
      {
        "supplier": "ControlCo",
        "name": "Safety controller firmware",
        "versions": ["3.8.0", "3.8.1", "3.8.2"],
        "content_hashes": ["1111111111111111111111111111111111111111111111111111111111111111"]
      }
    ],
    "remedy": "Update to 3.9.0 and re-run the stop-performance test.",
    "reference": "https://controlco.example/advisories/CTRL-2026-11",
    "fixed_versions": ["3.9.0"]
  },
  "manifest": {
    "manifest_id": "MAN-0412",
    "machine": { "manufacturer": "Grimaldi", "model": "AR-7", "serial": "0412", "site": "Plant 2, Line 4" },
    "source": "as_found",
    "taken_at": "2026-09-01T00:00:00Z",
    "taken_by": { "identifier": "a.integrator", "role": "safety engineer" },
    "items": [
      {
        "item_id": "ITM-FW",
        "kind": "firmware",
        "name": "Safety controller firmware",
        "version": "3.8.2",
        "content_hash": "1111111111111111111111111111111111111111111111111111111111111111",
        "hash_source": "read_from_machine",
        "supplier": "ControlCo",
        "implements": ["SF-01", "SF-02"]
      }
    ],
    "functions": [
      { "function_id": "SF-01", "description": "Protective stop on zone intrusion", "required_performance": "PL d", "verified_by": ["ssm_separation", "stop_characterisation"] },
      { "function_id": "SF-02", "description": "Speed limit in collaborative operation", "required_performance": "PL d", "verified_by": ["speed_limit"] }
    ],
    "method": "read via controller service port"
  }
}

Result

This endpoint is not hosted publicly yet — click Run to see exactly what that means and how to run it yourself.

This calls the real POST /v1/check/machine endpoint on one machine, free, no account. Enrolling the machine unlocks POST /v1/check/fleet-machine: the same check joined to its intervention history, its evidence staleness, and the fleet-wide fan-out across every other enrolled machine — the Cell plan.

Explore products

Plans, engines, and the API, in one place.

Every row below maps to code that runs. Nothing on this page is listed that the software does not do. Engine tiles link to the buyer-facing guide for that engine; plan tiles link to pricing.

The free CRA Article 14 validator — try it right here

POST /v1/spec/validate — edit the payload

Response

FastAPI surface for billing and entitlements. `GET /v1/plans` returns the pricing table generated from the entitlements the software enforces. Self-host with uvicorn today.

View source

Solutions

Built for the people who sign, verify, or get blamed.

Five buyers, five reasons the paperwork stopped describing the machine.

Manufacturer

Your Declaration of Conformity is only true the day you sign it.

You shipped a machine with a Declaration of Conformity, a risk assessment, and a CE mark. Every firmware patch, scanner re-zone, or PLC change since then is a day that Declaration has been quietly less true — and nothing in your process says so.

See the manufacturer page Plant operator

You did not change the firmware. You will still be asked to explain what did.

A safety controller update, a re-zoned scanner, a PLC project patch — often pushed by an integrator or a remote service call you were not in the room for. When something goes wrong, the plant is where the questions land first.

See the plant operator page Compliance officer

The 24-hour clock does not pause for a spreadsheet.

CRA Article 14 gives you 24 hours from awareness of an actively exploited vulnerability to file an early warning naming every Member State where the product is available. Getting the clock right, the reasoning right, and the field-5 territory list right, under that pressure, is not a spreadsheet problem.

See the compliance officer page Insurer / auditor

You should never need an account to verify a claim.

A manufacturer hands you a Declaration of Conformity, an attestation, or a safety verification bundle. Your job is to check whether it is real, current, and internally consistent — and you should not need to buy anything to do it.

See the insurer / auditor page AI / ops platform team

The assurance product sits on a real integration layer — not a demo.

NeuralBridge is the FastAPI backend, MCP gateway, and connection model the assurance product is built on. If your team is exposing tools to AI agents or wiring up connection state, this is the layer underneath, not a separate pitch.

See the ai / ops platform team page

Pricing

Three tiers. Verification is free at every one, always.

Assurance tiers are computed from the weakest input, never passed in. If it is not gated in code, it is not on this page — GET /v1/plans returns this same table, generated from the entitlements the software enforces.

Three objects on a bench representing Validator, Register, and Cell plans.

Which tier fits? Answer three questions.

Product families you manageArticle 14 cases per day, at peak

Do you need any of these?Machine safety verification (ISO/TS 15066 checks against a safety envelope)Machinery Annex III manifests and passportsFleet advisory fan-out across enrolled machinesCounter-signed head attestation

Register1 product family and up to 1 case(s)/day fit inside Register's 25-family, 50-case/day ceiling.

See Register pricing Talk to sales

Computed from the same limits src/assurance/billing/plans.py enforces — 25 product families and 50 cases/day on Register, machine verification / Annex III / fleet advisory / attestation gated to Cell only. Not a lead-gen guess.

Validator

Free

The free lead magnet. No card, no account required.

/ai control plane: discover + read (30/day) — writes need Register or Cell
Article 14 draft validation
ISO/TS 15066 separation calculator
Manifest diff
Advisory check
Declaration check
Bundle re-verification
Attestation verification

Get the quickstart

€390 / month

The Article 14 register for one manufacturer.

/ai control plane: unlimited reads, propose-and-approve writes, additional connections, full audit trail
Unlimited Article 14 cases
Both deadline clocks, computed correctly
Hash-chained ledger with verifiable export
25 product families
Everything in Validator

First 10 minutes: open a real Article 14 case, and unlock /ai’s write path (plan → approve → receipt) — with one key, no live checkout required to try it locally (see docs/buyer-journey.md).

Talk to sales

Cell

€1,290 / month

Everything in Register, for the full cell.

/ai control plane: unlimited reads, propose-and-approve writes, additional connections, full audit trail
Machine safety verification
Annex III manifests and passports
Fleet advisory fan-out
Declarations bound to a configuration hash
Counter-signed head attestation

First 10 minutes: open a real Article 14 case, and unlock /ai’s write path (plan → approve → receipt) — with one key, no live checkout required to try it locally (see docs/buyer-journey.md).

Talk to sales

There is also a fourth, unlisted tier — Supplier — for component suppliers who want to publish signed advisories to a hosted feed (POST /v1/supplier/advisory). It has no self-serve price yet, sales-assigned only per ADR-0001: get in touch.

Capability	Validator	Register	Cell
Free verification (Declaration, manifest, attestation)	✓	✓	✓
Article 14 draft validation & calculators	✓	✓	✓
Offline enrolment kit	✓	✓	✓
/ai control plane — discover + read (30/day)	✓	✓	✓
/ai control plane — propose-and-approve writes, bind connections, full audit	—	✓	✓
Article 14 register (unlimited cases, both clocks)	—	✓	✓
Hash-chained ledger with verifiable export	—	✓	✓
Machine safety verification	—	—	✓
Annex III manifests & passports	—	—	✓
Fleet advisory fan-out	—	—	✓
Counter-signed head attestation	—	—	✓

The plan cards above render live from GET /v1/plans when this page can reach a deployed API, and fall back to this static table (identical data) otherwise — that is the honest state right now: the billing API is real and tested (POST /v1/checkout refuses a payment it cannot provision rather than faking one, and every register route fails closed with no API keys configured), but it is not deployed to a public endpoint. Deploying it needs outbound access to Fly.io from wherever runs fly deploy, plus live Stripe keys — neither is available in the environment that built this page. See the billing routes and the deploy guide for the exact remaining steps.

The platform underneath

NeuralBridge: the integration layer the assurance product is built on.

A lightweight integration hub: a FastAPI backend, an MCP gateway for AI tool exposure, a small set of supported adapters, and a dashboard. It is intentionally narrower than it once claimed to be.

Ops desk with an MCP tool list, PostgreSQL and REST gateways, and a small FastAPI server.

Area	Current status
FastAPI backend	Supported
Connection management model	Supported
MCP tool listing / invocation	Supported
Dashboard foundation	Supported
Basic audit trail	Supported
Small set of working adapters (PostgreSQL, REST)	Supported
Broad adapter ecosystem	Evolving
Full enterprise compliance posture	Evolving

Full detail, including what is not yet claimed, is in the README.

Verify one Declaration for free. See what your paperwork stopped describing.

No account, no upload, no procurement cycle to start. The Validator tier runs on your machine today.

Get the quickstart Talk to sales