Questions we get asked

What does Glacis actually do?

Glacis puts enforcing controls at the points where an AI system acts — the inference boundary, each tool call, each agent decision — and records what those controls decided. Every governed action produces an Ed25519-signed receipt written to the OVERT open standard: a hash of the input, a hash of the output, which controls ran, what each one decided, a timestamp, and a position in a hash chain.

The controls execute inside your infrastructure. The receipt is the only thing that leaves.

Is this an AI observability product?

Observability tells you what your system did, in records your system wrote about itself. That is genuinely useful for operating a service, and weak as evidence — the party under examination produced the record, and could have amended it.

A receipt is a different category of artifact. A third party can check its signatures and hash commitments without trusting us, without an account, and without seeing your data. It sits underneath observability rather than replacing it.

We already use Vanta or Drata. Do we need Glacis?

Vanta and Drata document that you have policies. Glacis shows you followed them at runtime. They are complementary: one describes the programme, the other produces the runtime evidence the programme claims exists.

Is this a guardrails product?

There is a guardrail in it. Local controls can allow, block, redact, restrict, escalate, or require review before risky behaviour reaches a workflow, a tool, a record, or a customer.

What separates it from a guardrail library is the second half: each of those decisions leaves a signed record that someone outside your company can verify. A guardrail that fires and leaves nothing behind is an operational feature. A guardrail that fires and leaves a checkable record is evidence.

What is a governed action?

A governed action is any AI step a control was asked to evaluate: a model inference, a tool call, a retrieval, an agent decision. It is the unit a receipt describes.

If a control evaluated it, there is a receipt for it. If nothing was in scope, there is no receipt — and an evidence pack states the scope it covered rather than implying it covered everything. Scope you can read is worth more than coverage you have to assume.

Does our data leave our environment?

No. The arbiter runs inside your infrastructure and evaluates content in place. Prompts, outputs, documents, and records stay where they are. What crosses the wire is a hash, a control outcome, and a signature — never the content those hashes commit to.

That is the zero sensitive-data egress property, and it is structural rather than a setting: there is no path in the design by which a payload is transmitted. Proving what your controls did should not become a new way for data to get out.

Where do the controls run?

In your environment, next to the model or agent they govern, at the boundary where the risky step happens. For an ambient clinical scribe that is the model egress boundary, at the moment a draft note would leave. For an agent it is the tool-call boundary.

Receipts are produced in the same place, so the evidence trail does not introduce an egress path of its own.

What is actually in a receipt?

A receipt identifier, the OVERT format version, the named workflow, a signed timestamp, the outcome of each control that ran, the guardrail action with how many rules were evaluated and how many triggered, a SHA-256 hash of the input, a SHA-256 hash of the output, one or more Ed25519 signatures, and the receipt’s position in the hash chain plus the hash of the one before it.

No prompt text, no output text, no records — only commitments to them. You can read a full example on the sample evidence pack.

Who can verify a receipt, and what do they need from us?

Anyone you hand it to. Paste it into the verifier at verify.glacis.io and the checks run in the browser with WebCrypto: Ed25519 signature validity, the SHA-256 composite hash binding, structural and temporal consistency, and a Merkle inclusion proof where one is present.

The reviewer needs no account, no cooperation from us, and none of your data.

What does “witnessed” mean, and is every receipt witnessed?

Not every receipt, and the difference is worth being precise about.

Receipts minted through the Glacis portal at app.glacis.io are operator-signed and then countersigned by an independent Glacis witness, with an inclusion proof binding the receipt into a transparency log. Those are the ones the verifier badges as witnessed.

Receipts minted through the SDK on your own infrastructure are self-signed: a single Ed25519 signature, made with a key you hold. A self-signed receipt binds its own fields together honestly, but nobody independent countersigned it — and the verifier says exactly that, in amber, rather than colouring it green.

What is OVERT?

OVERT is the open standard the receipts are written to: the schema, the signing rules, and the verification procedure. It is published at overt.is, so a receipt is not a proprietary Glacis blob.

An auditor, a customer, or a competitor can implement a verifier from the specification and check your receipts without our involvement. That is the point of writing it down in public.

Does this make us compliant with the EU AI Act, ISO 42001, or the NIST AI RMF?

No, and no product does. Those frameworks ask you to define policy, assign ownership, tier risk, and keep records. Glacis addresses the record-keeping half, and only for what happens at runtime.

It lands most directly on EU AI Act Article 12, which requires logs generated automatically across a high-risk system’s lifetime: hash-chained receipts give that obligation a runtime artifact rather than a policy answer. Evidence packs export against NIST AI RMF, ISO 42001, the EU AI Act, and OSCAL.

Our buyers send AI security questionnaires. Does this help?

It is the most common reason teams arrive. Enterprise and health-system questionnaires now carry AI-specific rows on egress, logging, and control execution, and reviewers have stopped accepting an architecture diagram and a SOC 2 report as the answer to them.

A receipt the reviewer verifies independently answers those rows with cryptography instead of prose. The product was shaped by production deployment in exactly that setting, including an ambient clinical scribe, ~40,000 home-care visits a day.

How do we try it?

Two routes. Start free and mint your first receipt, then paste it into the verifier and check it yourself — the whole loop takes a few minutes and costs nothing.

Or bring one workflow to a 30-day Agent Runtime Security & Evidence Sprint, which maps the agent and tool surface, deploys runtime controls at the boundary that matters, and produces an evidence artifact you can put in front of a customer.

What does it cost?

A fixed-fee 30-day Sprint on one named workflow, which credits in full toward the first-year platform subscription, plus an annual platform subscription for ongoing runtime assurance. Founder design-partner pricing is available for the first three customers.

Figures depend on the workflow and the fleet, so we quote them directly rather than publishing a table. Book 30 minutes and you will get numbers on the call.

Is Glacis (glacis.io) the same company as Glacis (glacis.com)?

No. Two different companies, both in Seattle, and search engines and AI assistants routinely merge them into one entity.

We are GLACIS Technologies, Inc. at glacis.io, and we build runtime assurance and runtime evidence infrastructure for AI systems. Glacis at glacis.com is a separate business building supply-chain execution AI agents. We do not make supply-chain software; they do not make runtime evidence infrastructure. Our other domains are overt.is, docs.glacis.io, trust.glacis.io, app.glacis.io, and verify.glacis.io.