Data flow

Trace one representative workflow from the application to its stored evidence. Record the fields sent at each step and every external service involved.

Use the actual deployment configuration. Its operating-model name does not tell you which data crosses the network boundary.

Follow the application request

Customer application
  |
  | SDK telemetry and governed runtime calls
  v
Configured runtime destination
  |
  +--> central VeriProof endpoint
  |
  +--> entitled local Edge Gateway
         |
         | signed policy sync, stop state, and evidence reconciliation
         v
       central VeriProof endpoint
  |
  +--> ingest validation and storage
  +--> policy result
  +--> human-review workflow
  +--> role-aware portal projections
  +--> outcome record
  +--> integrity submission

The Edge Gateway path is optional and requires entitlement. It keeps ordinary governance calls local while a signed policy lease and governance profile remain valid. It reconciles accepted evidence and stop acknowledgements with the central endpoint.

The branches show responsibilities, not a fixed sequence for every request. Not every session requires human review or produces every record shown.

The application owns the call and resulting business action. VeriProof handles validation, policy evaluation, review records, and stored evidence within the deployed service boundary.

Content capture

Prompt and response content is disabled by default in the core SDKs. Enabling content capture changes the data sent to VeriProof.

Before enabling it:

• classify representative inputs and outputs;
• configure supported redaction;
• test the exact model call and adapter path;
• review stored records and exports; and
• approve retention and deletion behavior.

Pattern-based redaction does not prove that every sensitive value was removed.

Human review

When policy requires review, VeriProof records and routes the request. The application retains protected workflow state outside the callback request.

Before resuming protected work, verify the callback and recheck current policy and the conditions bound to the request. Use an idempotency key to prevent duplicate execution.

Allow for background updates

Background workers update governance, compliance, alerts, notifications, and assigned work after ingest. Views can therefore show a change at different times.

Compare the source identifier and recorded timestamps before treating different totals as missing data.

Integrity data flow

VeriProof computes and records integrity metadata, then submits the supported commitment to the selected provider.

An exported evidence pack contains the provider-neutral manifest and provider-specific proof references. veriproof-verify checks the pack without calling a VeriProof API.

Customer-managed Azure

Customer-managed Azure places the supported services and data stores in the customer’s subscription. The customer approves region, network, keys, storage, backup, restore, monitoring, and privileged access.

List any external dependency explicitly. Do not claim that only hashes cross the boundary unless the deployed architecture and observed network flows prove it.