Plumbline Evidence

Audit evidence for consequential decisions.

Plumbline Evidence helps regulated teams capture, verify, and replay the record behind a decision — including the model context when it matters.

For compliance reviewers Start with an evaluation pilotSee a live evidence sampleRead the executive briefFind your review path

Start with one model and one hard question. We can show the replay before any contract is signed.

The Plumbline question
PLU-001
“Can we show why this decision was made?”

One defensible record

Decision context, review, and evidence stay together instead of getting scattered across screenshots, inboxes, and spreadsheets.

Plumb line reference

A steady reference

The technical details are there when you need them. The first explanation stays human.

Browser access

Keep the evidence trail close.

Open Plumbline Evidence in your phone’s browser to review the evidence trail wherever the work takes you.

Request a walkthrough

§01 · What Plumbline does

The evidence should be easier to find than the question.

AI systems change. People change teams. Auditors ask questions long after a model made its call. Plumbline gives the people responsible for that system a calm, shared record of what happened and why it was accepted, escalated, or stopped.

  1. 01

    Start with the decision

    See what a consequential decision looked like when it was made, not just what the system says today.

  2. 02

    See what changed

    Catch drift, incidents, and unexpected patterns before they become a hard question for a reviewer or board.

  3. 03

    Keep the evidence together

    Capture inputs, scores, review notes, and approvals while the context is still fresh and attributable.

  4. 04

    Replay what happened

    Give your team, counsel, customer, or auditor a clear path back to the decision and its evidence.

§01A · The people behind the question

When the hard question comes, the evidence is already there.

The hard part is rarely one more dashboard. It is giving the people responsible for a consequential decision enough context to make a careful call, explain it, and return to it later.

Woman reviewing a decision record with colleagues standing behind her
The risk lead

“I need to know what changed before I decide what to do next.”

A review starts with the decision in front of the person who must own and defend the risk.

Four colleagues meeting around a table to review an action item together
The team

“Let’s answer the question together, while we still remember the context.”

A shared record gives operators, counsel, governance, and compliance the same place to begin.

Loading evidence preview

§02 · The proof

When the decision matters, the trail is already there.

Under the plain-English layer is a technical record: evaluation runs, drift signals, review notes, and signatures linked in sequence. It is built for replay, not for a last-minute reconstruction exercise.

Tamper-evident evaluation ledger#1,0370.951—EVALsig:7f3c…ad4#1,0380.947Δ −0.004EVALsig:4a91…0be#1,0390.882Δ −0.065INCIDENTsig:9b22…3f7#1,0400.913Δ +0.031RESOLVEDsig:cc15…8e1CHAIN · SHA-256 · SIGNED · REPLAYABLE

Evaluation record · signed · chained · replayable

The phrase “drift ledger” describes the mechanism. The benefit is simpler: your team does not have to remember what happened from a handful of disconnected tools.

  • Versioned. See the context around a decision without rebuilding the past.
  • Signed. Keep provenance close to the record it explains.
  • Access-controlled. Keep review and retention aligned to the way your team works.
Explore sample evidenceRegister your first model

A closer look

The moment a reviewer asks, “show me.”

Preview the same kind of evidence-led story your team can replay and share when the question is specific.

Open the live demo
Loading ad preview…
Download · Buyer brief
Healthcare · prior auth
See the audit path as one case, not four disconnected tools.
Get the one-page case study for a fictional mid-market healthcare network using Plumbline to capture, evaluate, review, and replay prior-authorization decisions.

Four moments the buyer can replay

  1. 01CaptureThe request lands with its context and scope.
  2. 02Evaluate / escalateScores and thresholds explain the manual-review path.
  3. 03ReviewNotes and sign-off stay attached to the decision.
  4. 04Replay / exportThe chain and signed evidence travel together.

Unlock the PDF

Leave an email for the next-step note, then the download appears here.

Fictional demo data only: Patient-7421 is not a real patient or PHI. The full walkthrough lives at /sample-evidence.

§03 · How it works

Start small. Make the next answer easier.

A pilot can begin with one model, one evaluator, and one question shaped like the one your team is already hearing. The useful proof comes before the paperwork.

Bring

One model
Register the system you need to understand, with the context your reviewers actually use.

Ask

One hard question
Pick a decision where clarity matters: a review, an escalation, a change, or a future audit.

Replay

The answer together
Walk through the record with the people who own the outcome — before a contract is signed.

§04 · Reassurance

Serious about the details. Clear about the limits.

Plumbline supports the evidence work behind regulated programs and consequential decisions. It does not turn a product page into a certification claim. The security surface is open for the people who need to inspect it.

Read the security overview
NIST AI RMF
US federal
Map, measure, and manage with evidence retrieval aligned to the risk profile.
EU AI Act
high-risk systems
Keep logging, monitoring, and technical documentation close to the decision trail.
HIPAA
healthcare
Use PHI-aware retention and access scopes. A BAA is available on the enterprise tier.
SOC 2 · SOX
enterprise IT
Make model-risk and change records easier to inspect with auditor-friendly exports.

§05 · Pricing

Three paths to evidence you can defend.
Start with the smallest useful proof.

Begin with a $1,000 Evidence Pilot: one workflow, one model, 30 days, and a replayable evidence package. The full pilot fee is credited toward Regulated Team if you continue at $1,500 per month. Larger programs can start with Enterprise from $12,000 per month.

The detailed offer and server-priced checkout live on the pricing page.

Start with the Evidence Pilot →See all three paths
Evidence Pilot
Start here
The full $1,000 pilot fee is credited toward Regulated Team.
$1,000 one-time
One focused workflow
Monitored models
1 model
Monthly evaluations
Focused scope
See the pilot path →
Regulated Team
Most direct
The full $1,000 pilot fee is credited toward Regulated Team.
$1,500 / mo
Team workspace
Monitored models
10 models
Monthly evaluations
Higher monthly quota
Start the team path →
Enterprise
Contact sales
Custom controls, residency, procurement, and deployment for larger programs.
From $12,000 / mo
Multi-team deployment
Monitored models
Unlimited
Monthly evaluations
Custom quotas
Contact sales →

A short learning loop

Help shape Plumbline Evidence
Not ready to sign up today? Tell us what would make replayable evidence useful for your team. Your responses help with product learning; you do not need an account or an email address to submit.
What kept you from signing up today?

Choose the closest reason. This helps us understand where the decision becomes difficult.

Leave it blank unless you want us to follow up about this feedback. It is not used to create an account or for anything else.

Required answers are marked with an asterisk. Feedback is reviewed for product learning, and the optional email is only for the follow-up invitation above.

Thanks — your feedback will help us shape what comes next.

§06 · Trust

What a reviewer needs to verify.

Three bands of evidence, each anchored to a control reference, a code path, or a tier term — not a hand-wave. The point is practical: a compliance reviewer or auditor can see what the record proves, what it does not, and where to replay the decision. A formal SOC 2 Type II audit is on the roadmap, not a present claim.

Column 01 · Compliance coverage

Frameworks, mapped to the questions reviewers ask.

Each framework below is grounded in a real catalog row — the same evidence mapping a compliance or governance reviewer can inspect on the crosswalk page.

  • HIPAA

    Controls mapped

    45 CFR § 164

    • §164.312(b) — Audit controls (replayable signed records)
    • §164.308(a)(4) — Access control (per-model API keys)
    • §164.312(c)(1) — Integrity (SHA-256 hash chain)

  • SOX

    ITGC mapped

    §404 ITGC

    • §404 — Management assessment of AI systems
    • ITGC — Change + logical access
    • ITGC — Audit trail retention

  • SOC 2

    TSC mapped

    TSC 2017

    • CC6.1 — Logical access (per-model isolation)
    • CC7.1 / CC7.2 — Anomaly detection + monitoring
    • CC4.1 — Monitoring of controls

Column 02 · Signed records

A cryptographic record a reviewer can replay.

The signed-record table is not reconstruction — it is the evidence a reviewer opens to understand what happened and verify the chain.

  • SHA-256 hash chain

    Every record is sha256(canonicalJson(record)). Tamper one row, break the chain — the replay finds it.

    sha256(eval) → sha256(eval·prev)

  • Key-anchored signatures

    Each capture carries a signature anchored to its registered model key. Provenance is a query.

    sig:7f3c…ad4

  • Replayable provenance

    Distinct (model, run) pairs in the same ledger. Auditor replays months later — no re-running inference.

    (model, runId) → chain

Column 03 · Security posture

Posture that holds up to a checklist.

What's in production today — verifiable in the code, the tier catalog, and the audit-bundle export.

  • Per-model API-key isolation

    SOC 2 CC6.1

    No model authenticates as another — the access boundary is the registered-model row.

  • Retention aligned to legal windows

    2,555-day default

    Team and Enterprise tiers default to the HIPAA / SOX-aligned 7-year window — not an out-of-the-box 30.

  • BAA on the enterprise tier

    Enterprise

    Healthcare buyers sign a BAA at the enterprise tier — on the order form, not ad hoc.

  • Tamper-evident audit bundle

    export_event

    One-click PDF export — eval records, drifts, alerts, retention, access — with a chain-of-custody seal.

§07 · The invitation

Bring us one consequential decision and one difficult question.

We’ll help you trace the answer from the decision back to the evidence — in a way your operators, risk leads, compliance reviewers, and leadership can all understand.

Request a walkthrough Email the team