AUDITING GUIDE
One of ChainMemory's most powerful capabilities is enabling verifiable audits of AI-assisted project decisions — without exposing private conversation content.
Two Levels of Audit
Level 1 — External audit (no owner access)
Anyone can verify that a project state was anchored at a specific point in time, without seeing what it contains. This is like seeing a notarized seal — you know it exists, you don't know what's inside.
What an external auditor sees (public, on-chain):
| Data | Visible | Reveals content? |
|---|---|---|
| state_hash | ✓ Public | No — SHA3-256 is irreversible |
| tx_hash | ✓ Public | No — only proves the transaction happened |
| block_number | ✓ Public | No — only proves when it was anchored |
| project ID (hashed) | ✓ Public | No — project name is hashed |
| version number | ✓ Public | No — only shows how many consolidations occurred |
| Memory content | ~ Ciphertext is on-chain | No — AES-256-GCM, unreadable without the owner key |
| Decision details | ✗ Private | Never on-chain |
| Project State | ✗ Private | Never on-chain |
Level 1 — Public endpoint
GET /v1/project/nova-logistics/state/anchor
Response:
{
"project": "nova-logistics",
"projectId": "0x77f7d980...", // hashed — original name not revealed
"version": 5,
"state_hash": "a7b3c9f2e1...", // proves state existed, reveals nothing about content
"anchor": {
"status": "anchored",
"tx_hash": "0xce55a800...",
"block_number": 125000,
"contract": "0xa7A8BA51...e7875"
}
}
a7b3c9f2e1... was registered at block 125000 on the ChainMemory blockchain. Nothing about the content is revealed. No API key required.
Level 2 — Selective disclosure audit (owner shares data)
The project owner chooses what to share with the auditor. The auditor then verifies the shared data against the on-chain proof. This is the powerful audit: you prove the data is authentic without an intermediary.
The owner controls exactly what gets disclosed:
| Disclosure level | What the auditor sees | Use case |
|---|---|---|
| State only | Decisions, milestones, risks, stack — no conversation text | Investor due diligence |
| State + selected memories | Decisions with supporting conversation excerpts | Compliance review |
| Full export | All memories, full state, complete history | Internal audit, legal discovery |
Step-by-Step Audit Process
Example: NovaTech, a startup building a logistics SaaS. After 4 months using ChatGPT and Claude alternately, the CTO needs to demonstrate project traceability to investors.
Owner exports the Project State
The CTO calls the API with their key and exports the state JSON:
bash
curl -H "x-api-key: cto-api-key" \
https://api.chainmemory.ai/v1/project/nova-logistics/state
Result: 12 active decisions, 3 superseded, 8 completed milestones, 2 open risks. The CTO shares this JSON with the investor.
Auditor computes the hash
The investor saves the received JSON as state.json and computes the state hash. The hash is SHA3-256 over a domain prefix (CM_PROJECT_STATE_V<schema_version>) plus the canonical form of the state object (keys sorted recursively, compact separators, UTF-8, state_hash field excluded). The open reference verifier does it in one command — Python standard library only, no dependencies:
bash
curl -sO https://docs.chainmemory.ai/verify_state.py
python3 verify_state.py state.json
# computed state_hash : 0xa7b3c9f2e1d4...
# declared state_hash : 0xa7b3c9f2e1d4... -> MATCH
# on-chain state_hash : 0xa7b3c9f2e1d4... -> ON-CHAIN MATCH
The verifier is ~90 lines of auditable code: it recomputes the hash independently and also checks it against the public on-chain anchor. No trust in ChainMemory required.
Auditor verifies against the blockchain
The investor calls the public verification endpoint (no API key needed):
bash
curl https://api.chainmemory.ai/v1/project/nova-logistics/state/anchor
# Returns: state_hash: "a7b3c9f2e1d4..."
If the hashes match: the state is authentic and unmodified since the anchor date.
Auditor traces a specific decision (optional)
If the CTO also shared memory access, the investor can drill into any decision:
Decision d005: "Migrate from REST to GraphQL" has evidence: ["#45", "#67", "#82"]. The investor retrieves those 3 memories:
- Memory #45 — ChatGPT session discussing API performance bottlenecks
- Memory #67 — Claude session comparing REST vs GraphQL trade-offs
- Memory #82 — Final decision documented with rationale
Each memory has its own SHA-256 hash of its text, with no domain separator — not to be confused with the SHA3-256 domain-separated hash of the Project State. Content verified, provenance confirmed.
Privacy Guarantees During Audit
The critical guarantee: the owner always controls disclosure.
- Investors see decisions and milestones — not the raw AI conversations that produced them
- The blockchain proves authenticity without revealing content
- Memory text (actual conversation content) is only visible if the owner explicitly exports it
- The on-chain record contains hashes plus the encrypted memory content — even if the blockchain is public, without your key none of it is readable
- No third party, including ChainMemory itself, can force disclosure of memory content