Companion-AI duties — disclosure, crisis referral, annual reporting, anti-dependency — are defended with logs, not policies. Prose chat logs are unqueryable at scale, discovery-toxic, and mute on the questions the statutes ask: dependency, escalation, trajectory. A sealed, typed, per-relationship record answers them.
Audit substrate, not compliance guarantee: we do not certify compliance. We seal the records that make yours provable.
Statute list is descriptive, not legal analysis. Obligations vary and change; consult counsel for yours.
Each duty class reduces to a record type. All of them are EDM artifacts: schema-bound, sealed at capture, independently verifiable. The subject reference is operator-scoped: you choose the identifier. We recommend pseudonymous references — the record carries exactly what you pass it, and nothing else about the person.
Per-session, sealed, timestamped: the AI-status notice was shown, to this user, before the conversation got substantive.
Cadence duties need proof the re-notification actually fired, every long session, all year. Sealed events, not a cron log.
Detection ran, the crisis referral fired, and both are dated — sealed at capture time, when nobody was litigating yet.
Annual reporting needs an append-only, de-identified ledger reconciled against the registry — kept all year, not reconstructed in the reporting week.
Anti-dependency duties ask you to prove a negative over months. The per-relationship, contemporaneous, typed emotional-state record is the answer.
Record types are implemented as EDM event extensions — schema fixed, payload yours. Talk to us about your event schema.
Memory systems optimize what a model recalls next — they compress, rewrite, and forget by design. That is good memory engineering and fatal record-keeping: a record a vendor's model may silently rewrite is not an audit record. Sealed EDM records preserve what happened, unmodified and provable, while your memory stack keeps doing its actual job.
The same separation applies to observability: traces are for your engineers and deletable by design. Beyond observation.
Designed so no prose needs to leave your boundary — identity tokenization, structural redaction, and BYOK deployment; available with design partners. A record can be sealed with its narrative prose withheld — structure only — while remaining schema-valid and verifiable.
Records sealed today are the evidence you'll wish you had in a year. Reconstructed evidence is exactly what gets attacked.