Guides

How do you prove to an auditor what your LLM calls actually did?

Application logs can be edited, so they are testimony, not evidence. What an auditor can actually accept for AI activity: complete records, tamper-evidence, independent verifiability, and how to get all three without a platform team.

Sooner or later an auditor, a regulator, or your own board asks a simple question: "show me what your AI did." Most teams answer with application logs, and most auditors know exactly what application logs are worth: whatever the person with database access says they're worth. A log your own admin can edit is testimony. An audit wants evidence.

What separates evidence from a log

Three properties, and you need all of them:

• Completeness. Every call is recorded at the moment it happens, by the system that made the decision, not reconstructed later from whichever services happened to have logging enabled.
• Tamper-evidence. Editing, deleting, or reordering any historical record must be detectable. The standard mechanism is a hash chain: each record's hash covers the record before it, so changing one breaks every one after it.
• Independent verifiability. The reviewer can check the records without trusting the vendor that produced them. That means a cryptographic signature and a verification tool that runs offline, so "the vendor says it's fine" never appears in the chain of reasoning.

What the record needs to contain (and what it shouldn't)

For each LLM call: timestamp, which model handled it and why (the routing decision), what screening ran before dispatch (PII, prompt injection) and what it found, token counts and cost, and an opaque end-user and session identifier so a finding can be traced to a person and a conversation. What it should not contain: prompt and response text. Content in an audit trail creates a second copy of your most sensitive data with a multi-year retention obligation. Metadata answers the auditor's questions; content creates new ones.

The test to run on any vendor (including us)

Ask one question: "can my auditor verify your export on an air-gapped laptop, without contacting you?" If the answer involves logging into the vendor's dashboard, the vendor is vouching for its own records, which is the exact structure the audit exists to eliminate. RemKey's answer: every governed call lands on a per-tenant hash chain, exports are Ed25519-signed, and a single-file, dependency-free verifier re-derives the entire chain and checks the signature offline. The verifier and the chain format are being prepared for open-source release, so the checking code itself is inspectable. The full mechanics are on the trust page, and the routing claims behind it are documented with their methodology on the benchmarks page.

Getting there without a platform team

The practical blocker is rarely conviction, it's that evidence collection sounds like an integration project. This is the job RemKey exists to do: be the AI layer you can prove to a regulator. Swap one base URL and your existing OpenAI or Anthropic code is unchanged, while every call from the first request is screened fail-closed, routed with a documented decision, and signed onto the chain your auditor verifies offline. No agent, no sidecar, no platform team. The financial-services page maps this to the specific questions regulated firms get asked.