Every behavior, measured. Every measurement, sealed. Every departure, a finding. Every finding, the team's call.
Aranthos measures the behavior of autonomous systems in production against their own learned baseline, zero AI and seals the proof. See drift as it happens. Prove what happened, years later, to anyone. Or that nothing did.
One number per system.
The first risk of an autonomous system in production is not the courtroom. It is the system drifting from its own normal, quietly, at production speed, while the infrastructure dashboards stay green.
Aranthos measures the distance between what the system is doing and what it normally does, live. Zero AI in the measurement loop.
The Drift Health Index (DHI) is a computation. It is not a model grading a model, and anyone owed an answer, a second line, an auditor, can recompute any value from the sealed record and land on the same score.
Not an alert. A finding.
Drift does not announce itself. Most teams learn about it downstream, from a reconciliation, a complaint, a number that stopped making sense, hours after the departure began.
Something is wrong, somewhere.
Which system. Which dimension departed. Since when. Against which learned baseline.
The first hour of an incident is spent finding out what is happening. Here, it is spent deciding.
It carries no invented severity and does no triage in the team's place: the finding says where to start, the decision stays with the team.
Findings route to where the teams already work.
Aranthos Connect: the full-fidelity path.
Our endpoint speaks OpenTelemetry: the open standard already emitted in production.
Nothing proprietary in the way.
Fidelity is decided at the tap point, not by the tooling.
Tapped before the sampler, the record is one to one, with a leading platform or nothing at all: the existing OpenTelemetry collector adds one export, nothing of ours is installed.
Tapped downstream, or read back from a dashboard, the record inherits the sample.
Everything saturates somewhere. What matters is what happens there: no sampling, and at any physical limit, a signed gap instead of a silent drop.
Lossless. Zero sampling.
Tools built for monitoring keep a sample. That fits dashboards. Proof needs the opposite: the first hostile question is what the sample left out.
the default target of a leading platform's automatic sampling
the only window where 100% of ingested data is queryable before retention filters
the default flat retention sampling, plus a representative selection
There, completeness is a cost. Here, it is the product.
Sampling drops events by design. Evidence writes a signed gap.
Built for dashboards: sampling under load, per-second throttles, retention tiers. By design, a percentage of the truth.
Built for evidence: lossless, unsampled. Every event, in order, or a signed gap.
Tapped downstream, the record is lossless from the moment we receive. Tapped at the source, it is full fidelity from the first emitted event.
A receive endpoint. Never an installed component.
In the record, or a signed gap. There is no third state.
The record answers hostile questions.
The day it matters, the reader is looking for the flaw. The record already holds the answers.
Every interval is on the record: the quiet days, the departure, and the gap itself. Nothing was sampled out, nothing chosen by anyone.
14 / 14 ACCOUNTEDOne sealed file. The whole record.
One object: a single sealed file carrying the record, the measurements, and the seals that bind them. It leaves the room.
Every event received in the covered window. Nothing sampled, nothing silently dropped.
Every DHI reading, decomposable into the observable elements behind it.
A signed gap record where a source went dark. Bounded, start to end, and signed.
A content signature and an independent timestamp. Three clocks, never merged: declared, received, attested.
Opens with the file alone. Verifies without Aranthos.
Verify an Evidence Packet (.EVP)
The timestamp comes from an independent time-stamping authority. Under eIDAS, an electronic timestamp cannot be denied legal effect or admissibility solely because it is electronic or not qualified.
The first case this instrument sealed is an early decision holding a company answerable for its autonomous system's behavior: measured against a learned baseline, signed, independently timestamped, and verified by a third party without an account.
Not the vendor. Not the host. Not the deployer.
The team decides.
It cannot act on the system.
Read-only by construction.
Whoever keeps the record has an interest in what it shows. Here a third party keeps it, and cannot touch what it measures.
Integrity risk is removed by construction: the write path does not exist, verified in the code.
Confidentiality is handled by controls: EU-hosted, encrypted in transit and at rest, read-only scoped credentials, auditable and revocable.
Built for the people who sign the risk register.
CISO, CTO, AI-platform and risk teams operating autonomous systems in production:
Why now
The management body bears the ultimate responsibility for this risk. The record is how it shows oversight actually happened.
Operational-resilience rules are live law.
No law requires an independent record today. Liability already rewards one.
From December 2026, under the new Product Liability Directive, a court can order disclosure of evidence and, where a defendant fails to comply with that order, presume the product defective. The presumption is rebuttable.
On a high-risk system, the question is never whether it will drift. It is whether it was being measured when it did.
Access is limited to a small number of design partner organizations.