ProlixoTech Documentation

Cryptographic Compliance Evidence Infrastructure

Why ProlixoTech?

Not all evidence is created equal. Here's what makes ProlixoTech different from regular logging — and why enterprises choose it for defensibility.

Installation

Requires Python 3.9 or higher. Choose your operating system:

pip3 install solymus

python3 -c "import solymus; print('Success!')"

py -m pip install solymus

py -c "import solymus; print('Success!')"

Get Your API Credentials

1. Sign up at prolixotech.com/signup.html
2. Verify your email address
3. Log in to the dashboard
4. Copy your Tenant ID and API Key from the dashboard

Quick Start

Get started with ProlixoTech in three steps:

1. Initialize the Client

from solymus import Solymus

# Initialize with endpoint, tenant_id, and API key
client = Solymus(
    endpoint="https://api.prolixotech.com",
    tenant_id="my-company",
    api_key="YOUR_API_KEY"
)

2. Fire-and-Forget (Non-blocking)

# Non-blocking - events queued and sent in background
event_id = client.record("model_inference", {
    "model": "gpt-4",
    "prompt": "What is AI?",
    "response": "AI is...",
    "tokens": 150
})
# Returns immediately with event_id
print(f"Queued: {event_id}")

3. Synchronous (Blocking, Returns Receipt)

# Synchronous - waits for server confirmation
receipt = client.record_sync("critical_decision", {
    "decision_type": "loan_approval",
    "outcome": "approved",
    "confidence": 0.95
})

# Receipt is a dataclass with these attributes:
print(f"Event ID: {receipt.event_id}")      # Unique identifier
print(f"OK: {receipt.ok}")                  # True if successful
print(f"Trace ID: {receipt.trace_id}")      # Correlation ID
print(f"Digest: {receipt.digest_b64url}")   # SHA-256 digest
print(f"Algorithm: {receipt.signing_alg}") # ECDSA_SHA_256

How Your Data Flows

When you call record() from the SDK or POST /ingest via REST, here is exactly what happens inside ProlixoTech's infrastructure:

Step-by-Step

What the receipt proves

When you call record_sync(), the receipt you get back contains:

This receipt is your cryptographic proof that the evidence existed in this exact form at the recorded timestamp. Auditors can verify it independently via GET /verify/{event_id} or the public verification URL in your exports.

5-Minute Demo

Test ProlixoTech with or without an AI provider. Choose an option below.

Option 1: Quick Test (No AI Required)

Test ProlixoTech without any AI provider. Only needs your ProlixoTech credentials.

Step 1: Get ProlixoTech Credentials

1. Go to your Dashboard
2. Copy your Tenant ID (shown on dashboard)
3. Click "Generate API Key" and copy the key

Step 2: Create test.py

Open Notepad, paste this code, replace your credentials, and save as test.py on Desktop:

from solymus import Solymus
TENANT_ID = "your-tenant-id"
API_KEY = "ak_live_your_key_here"
log = Solymus(endpoint="https://api.prolixotech.com", tenant_id=TENANT_ID, api_key=API_KEY)
receipt = log.record_sync("test_event", {"message": "Hello from Solymus!", "demo": True})
print(f"Event ID: {receipt.event_id}")
result = log.verify(receipt.event_id)
print(f"KMS Signature Valid: {result.kms_signature_valid}")

Step 3: Run

Windows:

cd Desktop
py test.py

Mac / Linux:

cd ~/Desktop
python3 test.py

Event ID: 3832bcb3-daea-4a9c-a198-96a249107f51
KMS Signature Valid: True

Option 2: Full Demo with AI

Test with a real AI provider. Choose one below.

Step 1: Install AI Package

Windows:

py -m pip install google-genai

Mac / Linux:

pip3 install google-genai

Step 2: Get API Keys

• Gemini API Key (Free): aistudio.google.com/apikey
• ProlixoTech Credentials: Your Dashboard

Step 3: Create demo.py

Open Notepad, paste this code, replace your 3 credentials, save as demo.py on Desktop:

from google import genai
from solymus import Solymus
GEMINI_KEY = "AIza..."
TENANT_ID = "your-tenant-id"
API_KEY = "ak_live_..."
client = genai.Client(api_key=GEMINI_KEY)
log = Solymus(endpoint="https://api.prolixotech.com", tenant_id=TENANT_ID, api_key=API_KEY)
response = client.models.generate_content(model="gemini-2.0-flash", contents="What is AI?")
print(f"Gemini: {response.text}")
receipt = log.record_sync("gemini_inference", {"model": "gemini-2.0-flash", "output": response.text})
print(f"Event ID: {receipt.event_id}")
result = log.verify(receipt.event_id)
print(f"KMS Signature Valid: {result.kms_signature_valid}")

Step 4: Run

Windows:

cd Desktop
py demo.py

Mac / Linux:

cd ~/Desktop
python3 demo.py

Gemini: Artificial intelligence (AI) refers to...
Event ID: 4a719f94-27eb-4a24-a36b-bfec34977a1d
KMS Signature Valid: True

Other AI Providers

Groq (Free, Recommended)

Install: py -m pip install groq (Windows) or pip3 install groq (Mac/Linux)

Get key: console.groq.com/keys (free, no credit card)

from groq import Groq
from solymus import Solymus
GROQ_KEY = "gsk_..."
TENANT_ID = "your-tenant-id"
API_KEY = "ak_live_..."
client = Groq(api_key=GROQ_KEY)
log = Solymus(endpoint="https://api.prolixotech.com", tenant_id=TENANT_ID, api_key=API_KEY)
response = client.chat.completions.create(model="llama-3.1-8b-instant", messages=[{"role": "user", "content": "What is AI?"}])
print(f"Groq: {response.choices[0].message.content}")
receipt = log.record_sync("groq_inference", {"model": "llama-3.1-8b-instant", "output": response.choices[0].message.content})
print(f"Event ID: {receipt.event_id}")
print(f"KMS Signature Valid: {log.verify(receipt.event_id).kms_signature_valid}")

Groq: Artificial Intelligence (AI) refers to the development of computer systems...
Event ID: 202c2e2a-e224-4740-9efb-0ab433f0441b
KMS Signature Valid: True

OpenAI (GPT-4, GPT-3.5)

Install: py -m pip install openai (Windows) or pip3 install openai (Mac/Linux)

Get key: platform.openai.com/api-keys

from openai import OpenAI
from solymus import Solymus
OPENAI_KEY = "sk-..."
TENANT_ID = "your-tenant-id"
API_KEY = "ak_live_..."
client = OpenAI(api_key=OPENAI_KEY)
log = Solymus(endpoint="https://api.prolixotech.com", tenant_id=TENANT_ID, api_key=API_KEY)
response = client.chat.completions.create(model="gpt-3.5-turbo", messages=[{"role": "user", "content": "What is AI?"}])
print(f"GPT: {response.choices[0].message.content}")
receipt = log.record_sync("openai_inference", {"model": "gpt-3.5-turbo", "output": response.choices[0].message.content})
print(f"Event ID: {receipt.event_id}")
print(f"KMS Signature Valid: {log.verify(receipt.event_id).kms_signature_valid}")

Anthropic Claude

Install: py -m pip install anthropic (Windows) or pip3 install anthropic (Mac/Linux)

Get key: console.anthropic.com/settings/keys

from anthropic import Anthropic
from solymus import Solymus
ANTHROPIC_KEY = "sk-ant-..."
TENANT_ID = "your-tenant-id"
API_KEY = "ak_live_..."
client = Anthropic(api_key=ANTHROPIC_KEY)
log = Solymus(endpoint="https://api.prolixotech.com", tenant_id=TENANT_ID, api_key=API_KEY)
response = client.messages.create(model="claude-3-haiku-20240307", max_tokens=1024, messages=[{"role": "user", "content": "What is AI?"}])
print(f"Claude: {response.content[0].text}")
receipt = log.record_sync("claude_inference", {"model": "claude-3-haiku", "output": response.content[0].text})
print(f"Event ID: {receipt.event_id}")
print(f"KMS Signature Valid: {log.verify(receipt.event_id).kms_signature_valid}")

Configuration

Configure ProlixoTech via constructor arguments or environment variables:

ProlixoTech Client

Constructor

Solymus(
    endpoint: str,                         # Required: API endpoint URL
    tenant_id: str = "default",           # Your tenant identifier
    api_key: str = None,                  # API key for authentication
    batch_size: int = 10,                 # Events per batch
    flush_interval: float = 5.0,         # Seconds between flushes
    max_queue_size: int = 1000,          # Max queue before blocking
    timeout: int = 10                     # HTTP timeout in seconds
)

Methods

record(event_type, payload, ...) - Fire-and-forget. Returns event_id immediately.

record_sync(event_type, payload, ...) - Synchronous. Returns Receipt object.

verify(event_id) - Verify evidence. Returns VerificationResult.

flush() - Force flush all queued events.

close() - Gracefully shutdown, flushing remaining events.

Receipt Object

Returned by record_sync():

VerificationResult Object

Returned by verify():

Compliance Schema Objects

Use these schema objects with record() or record_sync() for full EU AI Act and ISO 42001 compliance.

ModelContext (ISO 42001 / Article 12)

Track which AI model made a decision for full traceability and version auditing.

from solymus import ModelContext

client.record_sync("inference", {...},
    model_context=ModelContext(
        model_id="gpt-4-turbo",
        model_version="2024-04-09",
        model_type="llm",
        deployment_id="prod-us-east-1"
    )
)

SessionContext (Article 12 Usage Periods)

Record start and end times of AI system usage sessions, as explicitly required by Article 12.

from solymus import SessionContext
import time

session_start = int(time.time())
# ... AI system processes requests ...
session_end = int(time.time())

client.record_sync("session_complete", {...},
    session_context=SessionContext(
        session_id="sess_abc123",
        started_at=session_start,
        ended_at=session_end
    )
)

PerformanceMetrics (Post-Market Monitoring)

Capture performance metrics and anomaly flags for post-market monitoring requirements.

from solymus import PerformanceMetrics

client.record_sync("inference", {...},
    performance_metrics=PerformanceMetrics(
        latency_ms=234,
        confidence_score=0.92,
        input_tokens=150,
        output_tokens=50,
        anomaly_flags=["high_latency"]
    )
)

PolicyContext (Time Machine Defense)

Capture the exact policy/ruleset active at the moment of inference.

DataProvenance (Article 12 Data Lineage)

Track data sources used for AI inference.

HumanIntervention (Article 14 Oversight)

Record when humans review or override AI decisions.

Complete Evidence Example

Combine all evidence features to support compliance requirements in high-stakes AI decisions:

from solymus import (
    Solymus,
    PolicyContext,
    DataProvenance,
    HumanIntervention,
    ModelContext,
    SessionContext,
    PerformanceMetrics
)
import hashlib
import time

log = Solymus(
    endpoint="https://api.prolixotech.com",
    tenant_id="my-company",
    api_key="YOUR_API_KEY"
)

# Complete evidence record for high-stakes AI decision
receipt = log.record_sync(
    "high_risk_ai_decision",
    {
        "input": {"customer_id": "C789", "request_type": "credit_increase"},
        "output": {"approved": True, "new_limit": 10000}
    },
    # Time Machine Defense
    policy_context=PolicyContext(
        policy_name="credit_risk_policy",
        policy_version="4.2.1",
        policy_hash="sha256:e3b0c44298fc1c149afbf4c8996fb924..."
    ),
    # EU AI Act Article 12 - Data Traceability
    data_provenance=DataProvenance(
        reference_databases=["credit-bureau-experian", "transaction-history"],
        training_datasets=["risk-model-training-2025-q4"],
        data_version="2026-01-11",
        lineage="mlflow://experiments/risk-v4/run-123"
    ),
    # EU AI Act Article 14 - Human Oversight
    human_intervention=HumanIntervention(
        required=False  # No human review needed for this decision
    ),
    # ISO 42001 / Article 12 - Model Identification
    model_context=ModelContext(
        model_id="risk-assessment-v4",
        model_version="4.2.0",
        model_type="classifier",
        deployment_id="prod-us-east-1"
    ),
    # Article 12 - Usage Period Tracking
    session_context=SessionContext(
        session_id="sess_credit_review_123",
        started_at=int(time.time()) - 60,
        ended_at=int(time.time())
    ),
    # Post-Market Monitoring
    performance_metrics=PerformanceMetrics(
        latency_ms=234,
        confidence_score=0.89,
        input_tokens=150,
        output_tokens=50
    )
)

print(f"Evidence ID: {receipt.event_id}")
print(f"Cryptographic Digest: {receipt.digest_b64url}")

Async Usage

For async applications, use SolymusAsync with all the same compliance features:

import asyncio
from solymus import SolymusAsync, PolicyContext, DataProvenance

async def main():
    async with SolymusAsync(
        endpoint="https://api.prolixotech.com",
        tenant_id="my-company",
        api_key="YOUR_API_KEY"
    ) as log:
        receipt = await log.record(
            "model_inference",
            {"model_id": "claude-3", "tokens": 500},
            policy_context=PolicyContext(
                policy_name="inference_rules",
                policy_version="1.0.0",
                policy_hash="sha256:abc123..."
            ),
            data_provenance=DataProvenance(
                reference_databases=["docs-v2"],
                data_version="2026-01-11"
            )
        )
        print(f"Event ID: {receipt.event_id}")

asyncio.run(main())

Context Manager

Use the context manager pattern for automatic cleanup and flushing:

with Solymus(endpoint="...", tenant_id="...", api_key="...") as log:
    log.record("event", {"data": "value"})
    log.record("another_event", {"more": "data"})
# Automatically flushes all pending events on exit

@audit_log Decorator

Privacy Hashing

To protect PII while maintaining evidence integrity, hash sensitive data before logging:

import hashlib

# Hash sensitive data before logging
def hash_pii(data: str) -> str:
    return "sha256:" + hashlib.sha256(data.encode()).hexdigest()

# Log with hashed values
receipt = client.record_sync("inference", {
    "input_hash": hash_pii(user_prompt),  # Privacy-preserving
    "output_hash": hash_pii(response),
    "model": "gpt-4"
})

# The hash proves the data existed without revealing contents
# Perfect for GDPR compliance while maintaining evidence integrity

SDK & Integration Support Matrix

JavaScript / TypeScript SDK

API Authentication Contract

All API endpoints use https://api.prolixotech.com as the base URL. Authentication varies by endpoint category:

POST /ingest

POST /ingest

Batch ingest evidence events. Requires X-Api-Key header.

Authentication

# All evidence endpoints require API Key authentication
curl -X POST https://api.prolixotech.com/ingest \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -d '{"tenant_id": "your-tenant", "event_type": "inference", ...}'

Request Body

{
  "events": [
    {
      "event_id": "uuid",
      "event_type": "inference",
      "timestamp_ns": 1703750400000000000,
      "model_id": "gpt-4",
      "input_hash": "sha256:...",
      "policy_context": {...}
    }
  ],
  "tenant_id": "your-tenant"
}

GET /verify/{event_id}

GET /verify/{event_id}?tenant_id=xxx

Verify cryptographic integrity of an evidence record. Requires X-Api-Key header.

# Private verify (requires API key — for your internal dashboards)
curl "https://api.prolixotech.com/verify/EVENT_ID?tenant_id=my-tenant" \
  -H "X-Api-Key: YOUR_API_KEY"

GET /public/verify/{event_id}

GET /public/verify/{event_id}

Public verification endpoint for auditors and external parties. No authentication required.

# Public verify (no auth — share this URL with your C3PAO or auditor)
curl "https://api.prolixotech.com/public/verify/EVENT_ID"

Returns the same cryptographic verification data (KMS signature validity, Merkle linkage, compliance status) without requiring an API key. This is the URL embedded in exported evidence packages.

GET /events

GET /events?tenant_id=xxx&start_date=YYYY-MM-DD&end_date=YYYY-MM-DD

Query and browse evidence records with pagination. Requires X-Api-Key header.

# Query events with date range
curl "https://api.prolixotech.com/events?tenant_id=my-tenant&start_date=2026-01-01&end_date=2026-01-06&limit=50" \
  -H "X-Api-Key: YOUR_API_KEY"

GET /certificate/{day}

GET /certificate/{day}?format=html|json

Generate a Certificate of Truth for a specific day. Requires X-Api-Key header.

# Get compliance certificate for a day
curl "https://api.prolixotech.com/certificate/2026-01-01?format=html" \
  -H "X-Api-Key: YOUR_API_KEY"

EU AI Act Compliance

ProlixoTech automatically captures data required by EU AI Act Article 12:

• Automatic logging: Every inference is recorded with cryptographic signatures
• Traceability: Merkle trees provide tamper-evident audit trails
• Duration tracking: Nanosecond precision start/end timestamps
• Reference databases: Log which knowledge bases were consulted
• Human oversight: Track human verifier attribution (Article 14)

Caremark Doctrine

Demonstrate board-level AI governance with verifiable evidence:

• Certificate of Truth: Monthly attestation documents for board presentations
• Oversight evidence: Prove "good faith" monitoring system implementation
• Policy documentation: Cryptographic proof of safety policies in effect

Solymus Installation

Solymus is the ProlixoTech SDK and evidence engine. It automates evidence collection and control mapping for defense contractors pursuing CMMC certification (and other supported frameworks). Choose your installation method:

Solymus Capture - Browser Extension

The fastest way to collect CMMC evidence. Capture screenshots, documents, and configuration screens with automatic control mapping.

Integrations

Upload evidence manually through the dashboard, or use the Python SDK and REST API to collect and submit artifacts programmatically:

CMMC / NIST 800-171

ProlixoTech serves as the evidence engine for CMMC 2.0 and NIST 800-171 compliance. Mapped to Rev 2 (current DoD contract baseline) with Rev 3-ready mapping in development. Instead of manual spreadsheets, automatically collect audit artifacts and map them to controls.

How ProlixoTech Supports CMMC

• Evidence Collection: Upload artifacts via dashboard, API, or Python SDK. Connectors for M365 GCC High and AWS GovCloud are on the roadmap
• Control Mapping: Each evidence record maps to specific NIST 800-171 controls (e.g., AC-2, AU-3, SC-7)
• SSP Evidence Appendix: Export an evidence appendix for your System Security Plan with artifact-to-control mappings
• POA&M Tracking: Track remediation items with timestamped evidence of completion
• Assessment-Ready Export: One-click export of evidence packages for C3PAO assessors

CMMC Evidence Recording Example

Log security control evidence with control family mapping:

# Record access control evidence (AC family)
from solymus import Solymus

log = Solymus(
    endpoint="https://api.prolixotech.com",
    tenant_id="defense-contractor-123",
    api_key="your-api-key"
)

# Log account management action (maps to AC-2)
log.record("access_control", {
    "control_family": "AC",
    "control_id": "AC-2",
    "action": "account_created",
    "user_id": "jsmith",
    "roles": ["analyst", "cui_access"],
    "authorized_by": "security_admin",
    "justification": "Project Falcon team member"
})

# Log audit event (maps to AU-3)
log.record("audit_event", {
    "control_family": "AU",
    "control_id": "AU-3",
    "event_type": "cui_document_access",
    "document_id": "DOC-2026-001",
    "classification": "CUI//SP-EXPT",
    "outcome": "success"
})

NIST 800-171 Control Families

ProlixoTech can capture evidence for all 14 control families:

CMMC Evidence Factory API

The CMMC Evidence Factory provides dedicated API endpoints for uploading artifacts that automatically flow through the ProlixoTech Trust Engine. Every artifact is SHA-256 hashed, KMS-signed, and Merkle-chained.

Upload Artifact

Request a presigned URL for secure artifact upload:

# Request presigned upload URL
curl -X POST https://api.prolixotech.com/cmmc/artifacts/upload \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: your-api-key" \
  -d '{
    "tenant_id": "acme-defense",
    "filename": "access-policy.pdf",
    "content_type": "application/pdf",
    "evidence_type": "policy_document",
    "source": "manual_upload",
    "tags": {"department": "IT", "cmmc_control": "AC-1"}
  }'

# Response includes presigned POST fields
{
  "artifact_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "upload_url": "https://prolixo-evidence-*.s3.amazonaws.com",
  "upload_fields": { ... }
}

Finalize Artifact

After upload, finalize the artifact to compute hash, map controls, and create the ProlixoTech event:

# Finalize artifact (triggers ProlixoTech integration)
curl -X POST https://api.prolixotech.com/cmmc/artifacts/{artifact_id}/finalize \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: your-api-key"

# Response includes ProlixoTech receipt
{
  "artifact_id": "a1b2c3d4-...",
  "sha256_hex": "7f3a9c...",
  "receipt_id": "e1f2a3b4-...",
  "receipt_digest": "xYz123...",
  "merkle_linked": false,
  "control_mappings": [
    {"control_family": "AC", "control_id": "AC-1", "confidence": 0.95}
  ]
}

Verify Artifact

Assessors can independently verify evidence integrity:

# Verify artifact via ProlixoTech endpoint
curl https://api.prolixotech.com/verify/{receipt_id} \
  -H "X-Api-Key: your-api-key"

# Response shows cryptographic proof
{
  "status": "verified",
  "cryptographic_proof": {
    "kms_signature_valid": true,
    "signing_alg": "ECDSA_SHA_256",
    "digest_b64url": "..."
  },
  "merkle_linkage": {
    "root_signed": true,
    "global_root_hash": "..."
  }
}

Artifact Lifecycle

Plan-Based Access

ProlixoTech offers three tiers with distinct feature access:

Error Responses

When accessing features outside your plan, you'll receive specific error codes:

403 - Plan Upgrade Required:

{
  "error": "PLAN_UPGRADE_REQUIRED",
  "message": "Certificates of Truth are available on Pro and Enterprise plans.",
  "current_plan": "starter",
  "required_plans": ["pro", "enterprise"]
}

403 - Retention Limit Exceeded:

{
  "error": "RETENTION_LIMIT_EXCEEDED",
  "message": "Your starter plan allows access to the last 7 days of data.",
  "earliest_allowed_date": "2026-01-08",
  "upgrade_hint": "Upgrade to Pro for 1-year retention or Enterprise for unlimited."
}

429 - Quota Exceeded:

{
  "error": "quota_exceeded",
  "message": "Monthly event limit reached (1000/1000). Upgrade to Pro for 100K events/month.",
  "current_count": 1000,
  "monthly_quota": 1000
}