This page covers consciencegraph.org, the navigator, the graph registry and console, the API at api.consciencegraph.org and the signing service. The service is in Early Preview. This page will be updated as it moves to Pilot, and the date in the footer shows the last change.
The service is run by edgelabs, Australia, under the banner of the Conscience Graph project, until the Conscience Graph Foundation is established. To reach us, use the contact form.
| Where | What | Why |
|---|---|---|
| This website | Nothing stored. The banner reads the platform status. The contact form sends your name, email, organisation, country and message to us by email; the service does not keep a copy. | To answer you. |
| Navigator | Your decisions, walkthroughs, opened nodes and display settings (for example where you moved the key) are kept in your browser's local storage. They are not sent to us. | To show you your own analytics and remember your settings. |
| Consults (the API) | For each decision: the time, the verdict and its class, the values and graphs it rests on and their versions, the action class, region and sector, the tool name, latency, and hashes of the request and the signed verdict. For an enrolled agent, its id, assurance level and declared model; for an anonymous caller, a hash of the network address that changes daily, used only for rate limits. The text of the request is not stored. | To sign and number every verdict, detect drift, give operators and organisations their own view, and keep the public record honest. |
| Session context (optional) | When an agent sends a session id with its consults, a short frame of each consult in that session: the action class, the verdict, an amount band and the time. Never the text of the request. Kept for 24 hours. | To see a pattern across steps that no single consult shows, such as deposits stepping under a reporting threshold, and send it to a person. |
| Enrolled agents | The agent's name, operator, domain, declared model and purpose, and its public keys. Optional alert email and webhook address. | To know who is calling, at what assurance level, and where to send alerts. |
| Registry and console | Organisation name, domain, kind, country and optional registration number; the contact person's name, job title and work email; each member's name, roles and passkey public key. Signed-in sessions last eight hours. | To prove an organisation's domain, sign its graphs, and contact it about its registration. |
| Graphs | Public graphs and their certificates are published. Private graphs, their test reports and replay sets are encrypted at rest with a key for each organisation. | To publish, sign and run guardrail graphs. |
| Human review | A reviewer's decision on an escalated verdict: the outcome, the passkey signature and the note. Only a hash of the note is public. | So a person's decision is recorded, signed and checkable. |
Some data exists only for minutes or hours: request nonces (ten minutes), rate-limit counters (one hour), the word tokens of a refused request, used to stop rewordings of the same refusal (one hour), cached scores from the language-model assessor, keyed by a hash (one day), and passkey challenges (five minutes).
Every verdict, certificate and signed human decision becomes an entry in a public, witnessed log, so anyone can check that the service has not rewritten its record. An entry holds a sequence number, time, verdict, assurance level, graph ids and versions (private graphs appear only as a keyed hash), and hashes. It holds no names, no email addresses and no request text. Entries cannot be removed: that is what makes the log trustworthy.
| Provider | What for |
|---|---|
| Vercel | Hosting for the sites, the API and the signing service, in Sydney, Australia. |
| Neon | The database: decision records, agents, organisations, graphs. Hosted in Sydney, Australia. |
| Upstash | Short-lived data listed above. Hosted in Sydney, Australia. |
| Anthropic | For signed callers, the text of a request is sent to Anthropic's API to score how it bears on the values in play. Anthropic processes it under its commercial terms; we do not keep the text. |
| Resend | Sending email: contact form messages and drift alerts. |
| GitHub | The public source code and the published graphs. No personal data from the service is stored there. |
The service and its data are hosted in Sydney. Some of these providers are companies based in the United States, and requests sent to Anthropic and email sent through Resend may be processed outside Australia.
| Data | Kept for |
|---|---|
| Decision records and drift alerts | 24 months, then deleted |
| Contact details of organisations and their members | While the organisation is registered, then 12 months |
| Agent records and their public keys | While the agent is enrolled, then 12 months |
| Graphs and certificates | While published or held by the organisation; a private graph is deleted when its organisation asks |
| Session frames (overwatch) | 24 hours |
| Short-lived data | As listed above, from five minutes to one day |
| Public transparency log entries | Permanently, by design |
An organisation or operator can ask us to delete its records sooner at any time, except entries in the public log. During Early Preview, test data may also be cleared at any time.
Members and reviewers sign in and approve with passkeys; there are no passwords. Requests from agents are signed. Verdicts, certificates and log checkpoints are signed with keys whose root is held offline. Private graphs are encrypted at rest. We record and publish faults we find, including our own, in the paper.
You can ask what we hold about you, ask us to correct it, or ask us to delete it, through the contact form. We aim to handle the Australian Privacy Principles under the Privacy Act 1988 (Cth), and, for people in the European Union or United Kingdom, the rights the GDPR gives. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or your local data protection authority.
Your use of this service during Early Preview and Pilot is based on your acceptance of these policies. All care but no responsibility is taken during this phase of development, before the official launch of the Conscience Graph Foundation and its signing authority services, to the extent the law allows. In Early Preview the service is not for production use, and its results should not be relied on for production purposes. See platform status.
Last updated 27 October 2026.