← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

Vetro Attest vs. signing your own logs

*Engineering comparison, not legal advice.*

A capable engineering team can build log integrity itself: hash each log file, sign the hash with a key in a cloud KMS or HSM, upload both to an S3 bucket, maybe with Object Lock. It is a reasonable design, and for many internal uses it is enough. This page is about where it stops.

What DIY signing does well

• Integrity against outsiders. If an attacker without access to your key changes a log, the signature no longer verifies.
• Origin. A signature from your KMS key shows the log came from a system that could use that key.
• Full control and low marginal cost. No vendor, no data leaving your account, and KMS signing operations are cheap.
• Fits your stack. You choose the format, the granularity (per event, per run, per day) and the retention.

If your threat model is "an intruder or a careless script tampers with logs", DIY signing is a solid answer.

What it cannot give you

The weakness is structural, not technical: you hold the key, so your signature cannot protect anyone from you.

• No proof against the signer. An auditor, a regulator, a customer in a dispute or a court asks whether the company rewrote the log after the fact. Your organisation can rewrite a log and sign it again with the same key. A self-signature does not rule that out.
• No independent time. The timestamp in a self-signed statement is whatever your system wrote. Cloud audit trails help, but they are yet another log in your own account.
• Per-file hashes miss structure. Hashing a whole file detects changes to that file. It does not show a reader which event followed which, or catch that a file was produced from a filtered source.
• Someone has to maintain and explain it. The verification procedure, key rotation, and a document explaining to an auditor why they should trust it: all of that is on you, and a homemade scheme is harder to explain than a standard one.

What Vetro Attest adds

Vetro Attest is the part you cannot build yourself: a signature by someone else.

It takes a Vetro ledger or an OpenTelemetry GenAI trace (OTLP/JSON), verifies or rebuilds its hash chain event by event, and, for 29 USD one-off, returns:

• an ed25519 countersignature by this independent service over the digest, event count and timestamp. The public key is published, and a free endpoint lets anyone check any attestation;
• a full EU AI Act report (Markdown and HTML) mapping the run onto logging obligations (Art. 12, with context on Art. 14, 19 and 26).

The statement is small JSON: statement, signature, public key. It sits next to your own signature and does not replace it.

Plainly: our key lives on our server, and its compromise would weaken past attestations, which is why the public key is published for you to pin. The countersignature does not say the events are true, only that the log verified at that time.

When to use both

A layered setup that holds up to outside scrutiny:

1. Your own signature at the source: KMS, HSM, or the open-source Vetro recorder, which signs each ledger with your key.
2. An independent countersignature on runs with legal or commercial weight, obtained soon after the run.
3. WORM storage for both, for your retention period (see hash chain vs. WORM).

Your signature says "this came from us". The countersignature says "and it already looked like this when someone else saw it".

Try it

• Free EU AI Act Art. 12/14 checker, in the browser.
• Verify a ledger or trace free, then get the countersignature and report for 29 USD, no account.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.