From Chatbot Logs to Audit-Ready Proof in Two Minutes

Your chatbot already writes the evidence you need. It is sitting in a log file nobody has looked at since the last incident. Here is what happens when you point Trustra at it.

Most teams assume proving AI governance means a new project: instrument the app, add a compliance layer, brief legal, wait a quarter. The AI Flight Recorder skips that path entirely. It reads the logs your chatbot already produces. There is nothing to build inside your application, and nothing your users would notice.

Step one: point it at your logs

You choose one of three ways in, depending on how much control you want. Run the open-source local reader, pip install trustra, then point it at your log files with a command such as trustra read ./logs/*.jsonl. Formats are auto-detected, and personal data is redacted on your machine before anything ships anywhere. If you would rather not install anything, upload log files in the Trustra Cloud dashboard or forward them from your existing log store, and Trustra normalizes, redacts, and chains them on arrival. If you want live capture from the first token, route your model calls through the Trustra API gateway instead.

All three converge on the same result: your interaction history starts becoming a structured, evaluable record, without a code change to the product your customers use.

Step two: evidence builds itself

This is where the two minutes mostly goes. Every interaction is hash-chained at ingestion, each entry linked to the one before it, so the sequence cannot be quietly reordered or edited later without the chain visibly breaking. While that happens, automated risk detection runs over the same data: disclosure gaps, where a user was never told they were talking to AI, prompt injection attempts, and toxicity in either direction of the conversation.

You do not have to review anything to get this far. The detection runs on ingestion, not on a schedule, so by the time the read finishes, the findings already exist.

Step three: export the proof

One click produces an audit-ready report mapped to the EU AI Act, India's DPDP Act, the NIST AI RMF, and ISO/IEC 42001. It is something you can hand to a regulator, an enterprise customer's security team, or your own board, without translating it for them first, because the mapping to their framework is already done.

A real run against 1,849 interactions collected over 30 days looked like this:

That 96 percent disclosure figure is the one worth sitting with. It means 4 percent of conversations in that sample did not clearly tell the user they were talking to AI, which is precisely the gap Article 50 of the EU AI Act was written to close. Nobody had to guess that number. It came straight out of logs the team was already writing.

What an auditor sees on the other side

An auditor does not want your assurance that the guardrails work. They want to check for themselves. The chain lets them: click any record and try to tamper with it, and verification catches the break instantly, because each entry is SHA-256 linked to the one before it. The report itself is signed and timestamped, so it establishes not just what happened, but when the record was produced and that it has not moved since.

That is the difference between a compliance narrative and evidence. A narrative is written to be believed. A record is built to be checked.

Where this leads

The Flight Recorder is the entry point, not the ceiling. Once your interaction history is on the evidence chain, the rest of the platform reads and writes to the same record: observability for drift and quality, guardrails that enforce the limits your policy states, an evaluation harness that gates CI on regressions, and a DPDP audit workbench for the auditors who have to sign off on all of it. None of that requires starting over. It is the same chain, extended.

The whole exercise, from a cold start to a report you could hand a regulator, is genuinely about two minutes if your logs are already in a standard format. The honest caveat is that two minutes gets you a baseline, not a finished governance program. What it does get you is the thing most teams do not have today: a real number, backed by a record, instead of a guess.