00About
Every agent action should be answerable.
Companies handed real work to software faster than they built a way to account for it. Ovelin exists to close that distance: one record of what your agents did, sealed as it happened, that holds up when somebody checks.
01Why
The activity is real.
The paper trail isn’t.
AI agents classify customers, move money, answer support tickets and read sensitive data across a dozen tools. Meanwhile the EU AI Act, NIST AI RMF, HIPAA and ISO/IEC 42001 are turning “what is your AI doing?” from an awkward question into a documented obligation.
The teams we build for are not looking for another dashboard. They need something they can hand to an assessor, or to their own security team, without writing a narrative around it first. So the product is deliberately narrow: it keeps one thing, and keeps it in a form that survives scrutiny.
02Commitments
What we commit to,
and what makes it true.
- The record is append-only
- Database triggers refuse updates and deletes on the ledger for every role, including Ovelin's own service role. Entries are sealed with HMAC-SHA256, chained, and recomputed on read.
- Your data is isolated by the database, not by our code
- Row-level security scopes every query to your organisation, and application queries filter explicitly as well. Automated tests try to cross the boundary and must fail.
- Secrets never reach the trail
- Credentials, card numbers, and personal identifiers are stripped before an entry is written, because an append-only table cannot un-write them afterwards.
- You can take your data out, or erase it entirely
- Export the evidence binder whenever you want. Deleting your organisation removes every record, agent, and account for real, rather than setting a flag.
03Limits
What Ovelin is not.
- Not certification
- Ovelin records what your agents did and maps it to framework requirements so you can evidence your governance. It does not certify you against any framework, and it does not score you.
- Not legal advice
- We map obligations to the records that answer them. Your counsel stays in charge of interpreting what applies to you.
- Not a replacement for your tools
- It sits in front of your MCP servers or beside your existing tools — Claude Code, OpenAI, Make.com, n8n, your own code. How your agents run does not change.
- Not a copy of your data
- The trail records what an agent did, to which class of data, and when. It is metadata about actions, not a second store of the records themselves.