← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

Vetro Attest vs. WORM storage for AI agent logs

*Engineering comparison, not legal advice.*

When a team needs "immutable logs" for an AI system, the first answer is usually WORM storage: write once, read many. On AWS that means S3 Object Lock; Azure and Google Cloud offer immutable blob and bucket retention policies; many on-premise archives have an equivalent compliance mode. It is a good answer to a real problem. It is not the same answer as an independent countersignature, and the difference matters the day you hand the logs to someone outside your company.

What WORM storage does well

It blocks deletion and overwrite operationally. Once an object is locked for a retention period, the storage layer refuses to change it. In the strictest modes even administrators cannot shorten the lock.
It implements retention. The EU AI Act asks deployers of high-risk systems to keep automatically generated logs for at least six months (Art. 26(6)), and providers to keep the logs under their control (Art. 19). A locked bucket with the right retention period is a natural home for them.
It is boring infrastructure. Well understood by auditors, cheap, and already in most cloud accounts.

If you do not store your agent logs in something like this, you probably should.

What WORM storage does not give you

Proof that travels. The guarantee lives inside the bucket. When you export a log for an auditor, a customer or a regulator, they receive an ordinary file. They have to trust that it matches what was stored, and that the bucket was configured and locked when you say it was.
**Proof of *when*, from someone else.** Object metadata and retention settings are claims about your own infrastructure, made by you. A third party cannot check them from the file.
Evidence the log was intact before it reached the bucket. WORM protects the object from the moment it is written. If the log was assembled, filtered or edited upstream, the lock faithfully preserves the edited version.
A verifiable structure inside the log. A locked file is a blob. It does not tell a reader which event came after which, or whether one was removed from the middle before upload.

What Vetro Attest adds

Vetro Attest takes a Vetro ledger or an OpenTelemetry GenAI trace (OTLP/JSON), checks or rebuilds a hash chain over its events, and, for a one-off 29 USD, returns:

a full EU AI Act report mapping the log onto logging obligations (Markdown and HTML);
an ed25519 countersignature by this service over the ledger digest, event count and a timestamp, verifiable by anyone with our published public key, without an account and without trusting your storage.

That countersignature is a statement from a party with no stake in your logs: *this exact digest verified clean at this time*. You cannot produce it yourself, because you cannot sign as someone else.

What it does not do, stated plainly: it does not attest that the events are true or that your agent behaved well, and it does not store your logs long-term (paid ledgers are deleted after 7 days; the report and attestation are emailed to you to keep).

When to use both

For logs you may need to show as accountability evidence, layer them:

Record with a hash chain at the source, so edits anywhere in the log are detectable (see tamper-evident logs).
Get an independent countersignature on the runs that matter, so the log carries a timestamped proof from outside your organisation.
Store the log and the attestation in WORM for your retention period, so nobody can delete them quietly.

WORM answers "can this be changed where it is kept?". The countersignature answers "can someone outside prove it looked exactly like this back then?". Auditors increasingly ask both. There is a longer technical comparison in hash chain vs. WORM storage.

Try it

Run the free EU AI Act Art. 12/14 checker on your current logging setup. It runs in your browser.
Paste a ledger or an OTLP trace on the Vetro Attest home page to verify it free, then get the full report and countersignature for 29 USD, one-off, no account.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.