Etch

System of Records Provenance — Stripe for Record Integrity

The Problem

AI content generation has broken the foundational trust of digital media. A journalist files an investigative story; a generative AI publishes a near-identical version six hours later. A photographer uploads original work; a diffusion model produces a lookalike. A developer commits code; a competitor claims prior art. In every case, the question is the same: who created this first? And in every case, there is currently no lightweight, trustworthy answer.

But provenance is only half the problem. AI agents are collapsing the System of Records UI layer. What remains is authoritative data store + provenance + access control. Every clinical trial result, every research decision, every compliance event needs a tamper-evident record — not just a timestamp, but a namespace-isolated, API-key-authenticated system of record with cryptographic proof.

Blockchain-based solutions (Poet, Po.et raised $11M in 2017) attacked the provenance half but collapsed under gas fees, wallet friction, and Ethereum's throughput constraints. Enterprise SoR solutions (Veeva, Salesforce) have audit logs — but audit logs are editable. The problem remains entirely unsolved at scale.

The Solution

Etch is a REST API that provides namespace-isolated record storage with cryptographic provenance via Merkle Mountain Range (MMR) audit chains. Two API surfaces — the legacy `/v1/proof` for simple content timestamping, and the new `/v1/records` for full system-of-records functionality.

### Records API (v0.2.0)

POST /v1/records
{ "type": "clinical_trial_update", "data": {...}, "metadata": {...} }

→ {
    "record_id": "rec_8f2a...",
    "namespace": "trialsight_blumberg",
    "content_hash": "a3f1c2...",
    "mmr_root": "f7b3c1...",
    "timestamp": 1741650000.0,
    "chain_depth": 4821
  }

### Legacy Proof API

POST /v1/proof
{ "content": "My original article text..." }

→ {
    "proof_id": 4821,
    "content_hash": "a3f1c2...",
    "leaf_hash": "8d2e9a...",
    "mmr_root": "f7b3c1...",
    "timestamp": 1741650000.0,
    "chain_depth": 4821
  }

Every receipt is cryptographically bound to a specific position in the chain. Any tampering with the timestamp or content is detectable by recomputing the Merkle path.

Core Innovation

Etch provides namespace-isolated audit chains with API key authentication — each tenant gets their own chain, their own keys (`etch_live_sk_...`), and their own provenance history. The architecture is Stripe-style: simple SDK, instant integration, per-tenant isolation.

Records API Endpoints

POST   /v1/records                     # Create record → receipt
GET    /v1/records/{record_id}         # Retrieve by ID
GET    /v1/records                     # List records (filtered)
GET    /v1/records/{record_id}/proof   # Get Merkle proof
POST   /v1/records/{record_id}/verify  # Verify record integrity
GET    /v1/chain/root                  # Current chain root + depth

Market Timing

The EU AI Act (Article 50) mandates disclosure when content is AI-generated — **deadline August 2026**. Publishers and enterprises need tools to prove record integrity. Etch provides the cryptographic foundation.

The Content Authenticity Initiative (CAI — Adobe, BBC, Microsoft, Nikon) is pushing C2PA as the industry standard for content provenance. C2PA requires hardware camera integration and is useless for retroactive claims. Etch works on any content, already created, with a single API call. It is complementary to C2PA, not competing with it.

In life sciences: FDA 21 CFR Part 11 requires audit trails for electronic records. Veeva has audit logs — but audit logs are editable by admins. Etch provides mathematically tamper-evident provenance that no admin can retroactively alter.

Traction

• >TrialSight integration: All 10 clinical data sources stamp to Etch via fire-and-forget in API routes
• >61 tests passing (22 for records API)
• >Live in production with namespace isolation and API key auth

Revenue Model

Stack

• >Backend: FastAPI + Python
• >Chain: Merkle Mountain Range (MMR), SHA-256, PostgreSQL persistence
• >Auth: API key authentication with SHA-256 hashed key storage
• >SDK: Python (`etch.records.create()`, `.verify()`, `.proof()`, `.list()`)
• >Deploy: Production at eudaimonia.win

**Rising Sun** · [risingsun.name](https://risingsun.name) · April 2026

*"Where Veeva has audit logs, Etch has math."*