Every call, and every change to it, is bound to a tamper-evident record — the input digest, the model id and version, the output, the attributed clinician, and a cryptographic signature — each linked to the record before it. The ledger runs in production, and its head is anchored to a public, append-only transparency log with a checkpoint signed by a key that never leaves hardware. You can confirm, independently and with no access to us, that a specific model version on specific inputs produced a given call and that nothing was altered. The production ledger is anchored publicly right now:
public log index 2051205018 →. Audit-grade, powered by Project
AIR.