For teams that get audited
Compliance asks before a strategy goes live. An allocator asks the same thing in diligence, and a customer asks it after a bad quarter. Answering means producing evidence about what your inputs held at a past instant, months after the run. PIT writes that evidence at the time: the response body carries its own proof, a production agent can record a receipt for every decision it makes, and a run can be certified so a reviewer checks it without taking your word or ours.
What you use
01
Switch auditing on for a key and every /v1 response
served to it is recorded as a receipt line: the timestamp, the
route, a digest of the parameters, the corpus version, and a
SHA-256 over the envelope that was served. Receipts are kept 400
days, which covers an annual audit cycle. Desk plan.
02
A signed verdict on one run: what the agent was shown, when each
item was knowable, the control-arm deltas, and the
reasoning-audit findings. The signature is ed25519 over the
certificate body, and certverify exits with a
different code for each way a check can fail.
03
Submit a certificate and it is private to you until you list it. A comparative view appears only once a cell holds at least five listed submissions signed by at least three distinct keys, so one key cannot rank itself.
The envelope
The envelope is the wrapper of fields every answer comes back in. It carries its own evidence, so the thing you archive is the response itself.
$ curl -s "$PIT/v1/sample/news?example=svb&as_of=2023-03-10T23:59:59Z"
{
"as_of": "2023-03-10T23:59:59Z",
"visible_by": "published_at",
"results": [{
"id": "0001193125-23-067777_719739",
"title": "SVB FINANCIAL GROUP 8-K",
"published_at": "2023-03-10T23:59:59Z",
"acceptance_at": "2023-03-10T22:23:03Z",
"content_sha256": "8a95862ef3953dd206f1afeb5a0ab19014b57f7f332b764e948f6514fdd2d06a",
"source_locator": "https://www.sec.gov/Archives/edgar/data/719739/000119312523067777/0001193125-23-067777.txt"
}],
"coverage": { "touched": ["sec.edgar/2023-03-10", "identity.ticker/SIVB@2023-03-10"], "missing": [] }
}
PIT=https://api.pit.aqx.llc. Trimmed to the fields under
discussion; the playground stamps sample: true and
reports corpus_version: "sha256:sample", where a keyed
answer names the real corpus version.
01
content_sha256 covers the bytes we parsed and
source_locator points at the filing on sec.gov. An
auditor can fetch the publisher’s copy and compare it
against what your run was handed, without asking us for anything.
02
coverage.touched lists every day the cut read, and a
complete day names the set of SEC form types it was measured
against. A cut that touches a day we never certified comes back
409 with that day named, so a hole never passes for a zero.
03
Each response names the corpus_version it was
computed from. Pin it next to a published result: if a later
answer differs, that version says the corpus moved underneath
it.
In production
An agent in production does not stop to write down what it read. Turn auditing on for its key and PIT does it server-side: one receipt line per response, holding the route, a digest of the parameters, the corpus version and a SHA-256 over the envelope that went out. The payload itself is not stored by default, because the corpus is content-addressed and the query is recorded, so the hash is enough to prove what was served. Months later, what the agent knew is answered from one line per response.
The log records every outcome a receipt can have, including the ones where a line was dropped, so a lost receipt arrives as a counted event rather than as silence. How the receipts are written
When the record gets edited
SEC rebuilds its full and quarterly index files every Saturday, folding in post-acceptance corrections: a row a later amendment superseded, a company-name fix, an accession pulled after the fact. A weekly job re-fetches every day we hold, compares it against the receipt for the bytes we stored, and reports which rows were added, deleted or rewritten. Once SEC has overwritten a Saturday, the old bytes survive only where somebody kept the receipt.
Terms
Desk is the plan the audit trail lives on: 1,200 requests a minute, 25 keys named and revoked one at a time, the parquet partitions as files, and decision audit logs per key. It is a card checkout like the smaller two, and Stripe invoices every charge for the expense report. PIT has one login per account, so a Desk subscription is one account minting keys for the people and jobs that need them. Certificates and the reasoning audits behind them are priced apart from the subscription, and those terms are being finalized.
Procurement usually needs more than a card. An annual contract can carry a custom window of history, the sources you actually need, and a data processing agreement. It can also carry a security review and redistribution terms, if your own customers will hold the data. Those are negotiated one at a time, so write to operations@aqx.llc with what you need to query and who will hold keys. Self-serve on its own covers work you do for yourself or your employer; passing rows to your users is a commercial license.