Evidence, not just
observability.
AI agents now produce regulated data flows. VIGIL gives your agents pre-flight compliance checks they call before they act, each producing a signed, tamper-evident record of the decision, plus audit-grade event logs tagged with the regulatory frame at ingest. Mapped to 13 jurisdictions and 28 regimes.
Two stacks, one missing answer.
The buyer's actual problem
AI agents now produce regulated data flows. A retrieval-augmented chatbot touches a Quebec resident's record. A coding assistant logs an Aadhaar. The buyer's question isn't "can I see what my agent did?" or "am I compliant?". It is both at once: "what just happened, and was it legal?"
Why this doesn't split cleanly along existing tool lines
Observability tools (Datadog, Sentry, Splunk) capture what happened. Compliance tools (Drata, Vanta) document policies + run audits. Neither answers "is this agent action legal in real time?" The buyer has to wire two stacks together and write their own glue, usually after a regulator asks.
Why VIGIL is built differently
VIGIL captures every event AND tags it with the regulatory frame (DPDP / GDPR / PIPL / etc.) AT INGEST. The DPIA, ROPA, breach classifier, and cross-border registries all run against the live event stream. The dashboard and the compliance reports are the same surface, drawn from the same database.
Side-by-side.
Numbers you can verify.
Verify any number: /api/compliance/global-status, /api/.well-known/openapi, and /api/health/security are public + machine-readable.
Four things that make us different.
Operator-first, not enterprise-first
Most compliance tools are sold to CISOs of 500-person companies. VIGIL is built for the solo founder shipping an AI agent who needs DPIA + breach + cross-border notice in 5 minutes, not a 6-week audit kickoff.
Honest pre-audit readiness
We don't claim SOC 2 / ISO 27001 / HIPAA attestations we don't have. We DO publish detailed pre-audit readiness scorecards mapping every control to evidence. Procurement teams get the truthful answer they can verify.
Indigenous-owned, with real position
COSTRINITY operates from Treaty 4 territory (Regina, Saskatchewan). We support OCAP™ + CARE Principles + UNDRIP Article 31 because we live them, not because they're marketable.
Crypto-native + local-first
Solana Pay billing skips card networks. storage_mode=local means events stay on the operator's device. VIGIL stores nothing server-side. Data sovereignty as a default, not a checkbox.
VIGIL for agents, called by agents
The @costrinity/vigil-compliance-mcp package exposes 20 VIGIL compliance tools as MCP. Your AI agent can ask, mid-task: "Is this transfer DPDP §16 OK? Is this incident reportable? Is this AI use case high-risk under the AI Act?" and get the answer before it acts.
Try VIGIL in three steps.
Wire up MCP
Add @costrinity/vigil-compliance-mcp to your agent. Your LLM can now call VIGIL.