Keep a record of what your AI did

Your agent writes each execution — model, outcome, tokens, cost, latency — into an append-only, hash-chained record that someone who does not trust SPHIOR can still verify. Useful as supporting evidence for ISO 42001, the EU AI Act and SOC 2. Free to start, no card.

1. Start free

Records belong to an account, so you need one — but not a card. Create an account, then open the AI Governance settings and issue an ingestion token.

What the free tier does

It keeps recording up to 100,000 events a month and shows you the latest 10,000. Nothing is dropped while you are free — paying reveals what was already recorded, so a stretch on the free tier does not become a gap in your evidence. Past 100,000 a month, ingestion stops rather than silently billing you.

Create an ingestion token

2. Connect

Two ways in. MCP lets the agent record its own work; the REST endpoint works from any language with no SDK.

mcpServers config (Claude Code · Cursor · Codex · Windsurf · Cline · Zed · …)

{
  "mcpServers": {
    "sphior-ai-governance": {
      "command": "npx",
      "args": ["-y", "sphior-ai-governance-mcp"],
      "env": { "SPHIOR_AIGOV_TOKEN": "YOUR_TOKEN_HERE" }
    }
  }
}

Without a token the server still starts and tells you how to get one; nothing is recorded until it is set.

REST (no SDK required)

curl -X POST https://sphior.com/api/ai-governance/ingest \
  -H "Authorization: Bearer $SPHIOR_AIGOV_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "actor": "support-agent",
    "model": "your-model-label",
    "provider": "your-provider",
    "policy_decision": "allow",
    "tokens": 1840,
    "cost": 0.012,
    "latency": 1420,
    "trace_id": "req_01HX…"
  }'

3. What gets recorded

actor	Which agent or service ran.
model / provider / model_version	Your own labels — we do not infer them.
policy_decision	Your outcome, e.g. allow / deny / flag. We record it; we do not judge it.
input / output	A reference or a hash. Prompts and completions are not sent by default.
tokens / cost / latency	What it consumed.
occurred_at / trace_id	When it happened, and how to correlate it with your own logs.

4. Tools

record_ai_execution	Record one execution.
record_ai_executions	Record up to 200 in one call.

5. What the record is worth

Each record is canonicalised (RFC 8785), hashed with SHA-256, chained to the one before it, and folded into a Merkle root that is anchored externally. That is what lets someone re-check the record on their own machine without trusting us — the point of keeping it at all.

To be clear about the limits: this is supporting evidence, not an audit opinion and not a pass or fail. SPHIOR records what you report; your auditor decides what it means.

6. Data boundary

Hash-only is the default: prompts and completions are not sent — you send a reference or a hash of them. Storing raw content is an explicit, separate option, never the default. Retention follows the Privacy Policy.