Questions teams ask before adopting NexArt
Direct answers. No sales language.
Does NexArt see our prompts or outputs?
No. The SDK runs in your process. Sealing and verification are local. Only when you explicitly opt into attestation is the bundle sent to a NexArt node, and even then you control what the bundle contains via the redaction helpers.
Do our auditors need a NexArt account to verify a record?
No. The CLI and the SDK both verify offline. There is a published, implementation-independent specification of how the hash is computed, so an auditor can build their own verifier in any language if they want to.
What if NexArt goes away?
Bundles remain verifiable. The format is documented in the protocol spec. No service dependency.
What if we change AI providers?
Nothing changes. The format is provider-agnostic. CERs from OpenAI, Anthropic, Google, Bedrock, and self-hosted models all use the same schema and verifier.
Does this slow down our application?
Sealing a CER is a single hash computation over the record. Sub-millisecond on any modern hardware. Verification is the same cost. There is no network hop unless you opt into attestation.
Can we redact sensitive content while keeping the record verifiable?
Yes. The redaction helpers strip sensitive content from inputs and outputs while preserving a fingerprint of the original value inside a redaction envelope. The bundle still verifies end to end.
How do we adopt this without a big migration?
Start with one feature, one model call, one CER. Storage is your existing database, your existing object store, or your existing log pipeline. Bundles are JSON.
How does this differ from just signing our logs?
Logs sign a stream. CERs are individually verifiable, individually portable artifacts, with a fixed schema, a documented hash procedure, and a tooling ecosystem (SDK, CLI, integrations). Anyone can verify one bundle in isolation without access to the rest of your log stream. Unlike signed logs, a CER can be validated by a third party who has no access to your infrastructure.
Does this work in a browser, edge runtime, or Cloudflare Worker?
Yes. The SDK ships an async path that uses the browser's built-in cryptography APIs. Results are identical to the server path.
Is the bundle format stable?
Yes. cer.ai.execution.v1 is stable. Future evidentiary fields require a new bundle version and a new specification revision.
Is the node a blockchain?
No. It is a signed, append-only proof ledger backed by a conventional database. The node produces hashes that are suitable for anchoring on a blockchain, but the chain choice is yours.
What happens if the node goes offline?
Every signature ever issued by the node remains verifiable as long as the public key is available. We publish the key at a stable well-known URL. A node outage means you cannot create new attestations during the outage. It does not invalidate past ones.
Can the node lie?
The node could theoretically attest something false, but it cannot attest something false and hide it. Every attestation is signed, recorded in the ledger, and can be replayed by any verifier. A dishonest node would leave a permanent, cryptographically signed trail of its own dishonesty, visible to every integrator.
Does NexArt have its own SOC 2 or ISO 42001 certification?
NexArt does not currently hold SOC 2 or ISO certification. Verification of a Certified Execution Record requires no trust in NexArt: anyone can recompute the hash and check the Ed25519 signature against published keys. Operator-level questions, such as how signing keys are held, rotated, and governed, are separate from record verification. NexArt addresses these through documented controls and, where a customer requires it, formal certification. Independent verifiability covers the record; it does not replace operator assurance.
Does adopting NexArt mean adopting one tool per framework (SOC 2, ISO 42001, NIST, EU AI Act)?
No. One integration produces one evidence stream that maps across all four. The same Certified Execution Records are accepted as evidence for SOC 2 monitoring and incident-response controls, ISO 42001 traceability and accountability clauses, NIST AI RMF MEASURE and MANAGE functions, and EU AI Act logging obligations for high-risk AI systems.
What does NexArt not cover in our compliance program?
NexArt covers execution and inference. It does not cover training-time, model development, or retirement and decommissioning. It is the execution evidence layer and does not replace governance activities such as risk assessments, model approvals, model inventory, change management, or monitoring; it sits underneath them as one input an auditor consumes. It also does not replace identity and access management, encryption, bias and fairness evaluation, or human oversight controls. The bounded scope is deliberate: NexArt produces tamper-evident records of what your AI actually executed and integrates with the rest of your control stack rather than replacing it.
Can a third party independently prove when a record existed?
Yes. Certified Execution Records now carry an RFC 3161 timestamp issued via a public timestamp authority (DigiCert), providing an independent anchor of when the record existed that does not depend on NexArt. A dedicated contracted TSA is available for enterprise customers where required.
Ready to start?
Stage 1 takes under an hour: one function call, one CER. See the adoption journey to understand each step.
Most teams only realize they need execution evidence after an audit finding, a customer escalation, or a compliance review. By then, the executions they need to prove have already happened without records.
Start with a single certified execution
If you cannot reproduce a decision exactly, you cannot prove it. Stage 1 takes under an hour. See the step-by-step adoption path.
See the adoption path →