Compliance software that produces evidence
Proof that holds up.
Focused tools for HIPAA, SOC 2, ISO 27001, the EU AI Act and post-quantum readiness.
When an auditor, a client or a regulator asks “can you prove it?”, RootSystems gives you a report that answers, signed with post-quantum signatures (ML-DSA-65) and hash-chained, so any change to it shows.
- ML-DSA-65 post-quantum signatures (the algorithm in NIST FIPS 204)
- SHA-256 fingerprints
- AES-256 encryption at rest
Three branches
One root system. Every branch
answers a different question.
Compliance Proof
Offboarding, vendor risk, HIPAA and readiness for twelve standards. Evidence an auditor can check.
See the tools Branch 2Post-Quantum Signed
Find the cryptography a large enough quantum computer could break, and the patch that fixes it.
See the tools Branch 3AI Agent Trust
Signed agent authority, a ledger of every action, and a check against your contracts and insurance.
See the toolsHow verification works
Don’t take our word for it. Check the signature.
- 1Every report is signed.
Each report is signed with ML-DSA-65, the post-quantum signature standard NIST published in 2024, and fingerprinted with SHA-256, signed with ML-DSA-65 (with a SHA-512 digest of the signed data).
- 2The key is public.
Every compliance product publishes its signing key at a fixed address. You can check any report on the product's Reports page.
- 3Change one character and it fails.
An edited report no longer matches its signature. It proves the report came from us and is unchanged, and the signature is designed to stay verifiable after quantum computers arrive.
GET offboarding-proof.onrender.com
/.well-known/rootsystems-signing-key.json
{
"configured": true,
"algorithm": "ML-DSA-65",
"standard": "NIST FIPS 204",
"keyId": "a46b6270385f02a6aa7ee057c8614e2d",
"publicKey": "… 1,952 bytes …"
}