Trust is a control. So we removed it.
Every other “AI SOC” tool asks you to believe the vendor’s dashboard. Roxas Labs is engineered so that you, or your auditor, or your board, can check the work independently, offline, with no access to our systems.
Everyone says “it’s all auditable.”
The real question is whether you can check that, or whether you’re trusting that nothing changed between the vendor’s database and the export they hand you.
Hash-chained and append-only.
Every material event becomes a row, locked to the row before it by a fingerprint. Change or drop a row and the chain breaks. Rows can only be added, never edited or deleted.
- Sequential primary key: gaps are visible
- Per-entry Ed25519 signatures
- Concurrent writers can’t fork the chain
Signed checkpoints, anchored off-box.
On a schedule, the current chain head is signed and the checkpoint is written out: emailed to you, dropped in object storage, wherever you keep it. Because a checkpoint records where the chain was, a later chain that is shorter than a known checkpoint fails verification. Truncation isn’t just discouraged. It’s detectable.
- seq
- 1043
- head
- 9f55…7d0e
- sig
- 3a90…c1, valid
- stored
- email + blob container
Your auditor verifies it without us.
We export a self-contained bundle. Your auditor runs the verifier against it with no database access, no API key, no call back to Roxas Labs.
The attestation report.
A framework-mapped summary for any period: the thing you hand to a board, a regulator, or a cyber-insurance underwriter.
Q3 2026 · Acme Corporation
- True positive 18%
- Benign positive 21%
- False positive 57%
- Undetermined 4%
11 of 14 tactics seen and investigated
18 taken · 18 approved by a person · 2 open in the backlog
- Verdict mix, true-positive rate, human-review rate
- Time-to-triage and time-to-verdict, median
- MITRE ATT&CK tactic and per-rule coverage
- Response actions taken, open backlog, cost
- An integrity anchor: chain-verify result, head, latest checkpoint, public key
Where “we checked our dashboard” isn’t an answer.
CMMC / DIB
Defense supply-chain assessors want evidence a control operated, not a screenshot. A signed, offline-verifiable chain is that evidence.
Cyber insurance
Underwriters and MGAs are pricing on whether monitoring is real and auditable. A verifiable operations record is a rate conversation.
Board reporting
When the board asks whether monitoring is real, “trust our AI” doesn’t survive a bad quarter. A tamper-evident record does.
We’ll run the verifier with you.
Walk a full investigation, then run the offline verifier against the exported audit bundle together, with no access to anything but the file.