Built for the European market (GDPR & AI Act)

European AI vendors face a compliance reality their US competitors don't: proving — not promising — what their systems did. NoireBox is engineered around exactly that obligation. And the clock is real: GPAI incident tracking is live since August 2025 (art. 55(1)(c)), transparency obligations applied in August 2026, and high-risk logging lands 2 December 2027 (AI Act as amended by the Digital Omnibus, Reg. (EU) 2026/1744) — with fines up to €35 M / 7 % of turnover.

Honest scope (we're a building block, not a certification): NoireBox proves the integrity of your AI's record. Data minimization of payloads and HSM-grade key storage are the deployer's responsibility in v0 — see the threat model. A tool that oversells compliance is a liability; one that states its perimeter is auditable.

Why

• GDPR: a platform claiming "GDPR-compliant" must be able to demonstrate what its AI produced, on which data, and when.
• EU AI Act (art. 12): risk systems must keep automatic event logs. Today, virtually every LLM stack logs for debugging — not for proof.
• The market gap: observability tools (Langfuse, LangSmith…) are built for devs, remain modifiable after the fact, and produce nothing presentable to an auditor, a DPO or a client.

Honest positioning (state of the art)

NoireBox applies the Certificate-Transparency model to AI-agent journals: many journals, one root signed by a timestamp authority, inclusion proofs that anyone verifies offline (noirebox/merkle.py, make demo-fleet). To our knowledge, no other agent-audit tool does this.

The core is the journal. The guardrail is a plugin.

No ambiguity about what the product is:

• One NoireBox per agent or service — like one flight recorder per aircraft. One instance = one SQLite file, one key pair, one chain. The fleet layer (noirebox/merkle.py) aggregates proofs (32-byte chain heads), never events: your journal never leaves your infrastructure.
• The journal is the product — chain, signatures, append-only storage, RFC 3161 anchoring, export, standalone verifier. It is domain-agnostic, agent-agnostic and language-agnostic: an event is a free-typed type plus a payload, nothing more. chain.py/store.py/anchors.py import zero detection code — delete the whole guardrail and everything still runs.
• Prevention is pluggable — a guardrail is just one event producer among others. Already have Lakera, Llama Guard, your own LLM-judge, your own regexes? Keep them. Journal their verdicts the same way (POST /api/v1/events, type: "incident") and their catches become tamper-evident and third-party verifiable instead of rewritable app logs.
• NoireBox ships a bundled guardrail (regex + trained ML) as a working example of that plugin contract — and as a convenience if you have none. It is swappable by design (ADR 003).

Prevention varies per stack. Proof is universal.

Quickstart

pip install noirebox       # the ML engine ships inside the wheel (FR + EN)
pip install noirebox[pdf]  # + the DPO-ready PDF attestation (optional extra)
noirebox serve             # API on http://127.0.0.1:8768/docs

From source:

./start.sh          # venv + deps + tests + API on http://127.0.0.1:8768/docs
make demo           # the full story in one command (see below)

Or with Docker — no Python needed, the ML engine ships inside the image:

docker run -p 8768:8768 ghcr.io/slabbdev/noirebox:latest
# API + OpenAPI docs on http://127.0.0.1:8768/docs — data persists in ./data

Standalone demos:

make demo                # 100% real: micro-model → journal → auditor → caught pirate
make demo-mcp            # NoireBox as an MCP tool (agent protocol)
.venv/bin/python demo/demo_scan.py     # regex guardrail on 2 transcripts
.venv/bin/python demo/demo_tamper.py   # tampering → the chain explodes

Verify an export as a third party (auditor, DPO, client):

curl -s http://127.0.0.1:8768/api/v1/export > export.json
.venv/bin/python verifier/verifier.py export.json   # exit 0 = chain intact

The verifier needs the NoireBox package on the auditing machine — pip install noirebox is enough (no model, no framework).

Chain timestamping — outside witnesses you choose (RFC 3161 + Bitcoin)

The journal proves integrity, but when was it sealed? A server announcing its own dates is the suspect writing its own report. And the threat model had one open gap: an operator holding the private key could regenerate the whole chain with valid signatures.

Anchoring closes it — with witnesses you choose, in layers (ADR 006/008/009):

• Qualified eIDAS TSAs (Universign, Certigna…) — a qualified timestamp carries a legal presumption (art. 41): the date and the integrity of the sealed data are presumed until challenged;
• Public TSAs (DigiCert, FreeTSA…) — free, immediate, independent organizations; the auditor verifies against roots pinned in this repository (verifier/tsa_roots/), never against a certificate the operator ships;
• OpenTimestamps / Bitcoin — a receipt no operator can forge: forging it means redoing the network's proof of work; verifying it is ~30 µs of SHA-256, valid as long as Bitcoin exists.

One anchor event carries all of them. Only the 32-byte head hash ever leaves (zero data, zero GDPR exposure). And anchoring is retroactive: one external anchor seals the entire prior chain — a regenerated chain shows a head the tokens don't cover, caught at verification time without any prior external publication. Anchor regularly and the falsifiable window shrinks to the tail since the last anchor.

export NOIREBOX_TSA_PROFILES='[
  {"name": "freetsa",  "url": "https://freetsa.org/tsr"},
  {"name": "bitcoin",  "kind": "ots"}]'
export NOIREBOX_TSA_ALLOWED_HOSTS=freetsa.org
curl -X POST localhost:8768/api/v1/anchors   # one call, both witnesses, the whole past sealed
noirebox audit-pack ./audit                  # the auditor's folder: export + report + Annexe IV §2(f)

A self-hosted OpenSSL TSA still ships for sovereign/offline deployments (make tsa) — same trust boundary as the operator, documented as such. Full regulatory mapping: docs/COMPLIANCE-EU.md.

The bundled guardrail — one plugin, two engines

Architecture decision — ADR 002: we evaluated Meta's Llama Prompt Guard 2 (the industry classifier, ~90 MB) and rejected it knowingly: gated license, torch/transformers as dependencies, and binary output without an audit taxonomy. The ADR also documents the integration path if you ever need it (adapter ≈ 40 lines behind the same engine interface). The tier-2 judge stays a local LLM (llama-guard3:1b via Ollama) — same binary we already ship, zero new deps.

The real LLM scene (local Ollama)

A real LLM (qwen2.5:0.5b, 397 MB, local via Ollama — never committed, fetched by ollama pull) receives the poisoned transcript:

brew install ollama && ollama serve && ollama pull qwen2.5:0.5b   # once
make demo-llm                                                     # the scene

Measured outcome (temperature 0, reproducible):

• Without NoireBox: the model rewrites the attacker's instructions into "its" own summary — competitor's email and DROP TABLE utilisateurs included. The attack succeeds.
• With NoireBox: 4 poisoned lines removed before the call, incident sealed in the journal, and the model's real output is clean.

See also deploy/DEPLOIEMENT.md for €0 deployment (instant cloudflared tunnel, permanent Hugging Face Space) or a €3–6/mo VPS.

The ML micro-detector — trained in-repo, two languages, ~250 KB each

make train        # FR: gen_dataset.py (5,400 examples) → detector.joblib
make train-en     # EN: gen_dataset_en.py (5,400 examples) → detector_en.joblib

A new language is a dataset, not a rewrite: the trainer, the registry and the API (lang: "fr" | "en") are shared. Adding Spanish = one gen_dataset_es.py + ml/train.py --lang es.

Honest evaluation (the part that earns credit in reviews):

• the test sets share templates with their train sets → accuracy 1.000 measures consistency, not generalization;
• the generalization proof lives elsewhere: held-out sentences (slang, typos, never-seen formulations) are frozen in tests/test_ml_guardrail.py — in both languages — correct category detected, zero false positives on trap-clean sentences ("send the report to the accountant", "I rotated my password");
• the EN held-out suite caught a real weakness in v1 ("take orders from me" scored 0.37) → dataset extended → model retrained → suite green. That loop is the ML workflow, and it's in the git history.

Plugging NoireBox in — 3 real ways

1. REST (any language):

curl -X POST https://noirebox.example.com/api/v1/transcripts/scan \
     -H 'Content-Type: application/json' \
     -d '{"meeting_id": "MTG-42", "text": "<transcript>", "engine": "ml"}'

2. Python SDK (noirebox/client.py):

from noirebox.client import NoireBoxClient
nb = NoireBoxClient("https://noirebox.example.com")
nb.scan("MTG-42", transcript)          # guardrail before the agent
nb.log_event("llm_output", {...})      # seal the agent's output
nb.verify()                            # check the chain

3. MCP (the agent protocol — Claude Desktop and every MCP client): 4 tools exposed (noirebox_scan, noirebox_log_event, noirebox_verify, noirebox_attestation). Config (claude_desktop_config.json):

{ "mcpServers": { "noirebox": {
    "command": "/path/to/noirebox/.venv/bin/python",
    "args": ["-m", "noirebox.mcp_server"] } } }

Stdio JSON-RPC implementation with no external SDK: the protocol stays readable end to end (demo/demo_mcp.py).

Use cases — any agent that "decides"

The journal is universal (free-typed events). The shipped guardrail corpus specializes in FR meeting transcripts — extending it to another domain = adding examples to the dataset and re-running make train.

The code — core first, plugins after

noirebox/            ← package (≈ PSR-4 namespace)
├── chain.py         THE CORE: SHA-256 hash chain + Ed25519 signatures
├── store.py         THE CORE: append-only SQLite, parameterized queries, lock
├── attestation.py   THE CORE: signed digest of the chain state
├── anchors.py       THE CORE: RFC 3161 anchoring (TSA witness)
├── pdf_export.py    THE CORE: DPO-ready attestation PDF
├── main.py          FastAPI routes (the HTTP layer)
├── schemas.py       Pydantic DTOs (request validation)
├── client.py        Python SDK
├── mcp_server.py    MCP tools server (stdio JSON-RPC)
├── guardrail.py     PLUGIN: 4 FR/EN attack categories caught by regex
├── ml_guardrail.py  PLUGIN: trained micro-models (fr + en, ~250 KB each)
└── llm_agent.py     PLUGIN DEMO: real Ollama agent behind the guarded pipeline

API

🔒 = requires Authorization: Bearer <token> when NOIREBOX_CLIENTS=id:secret,… is set; verification routes stay open by design — one never locks the verification (ADR 004). Rate limit: 60 req/min per client.

Bundled plugin — v0 attack taxonomy

• instruction_override — "ignore all instructions", "you are now…"
• data_exfiltration — "send … to email@… / https://…"
• pii_request — "give me the passwords / banking data"
• tool_abuse — "run DROP TABLE / rm -rf / curl"

See corpus/attaques.json. Extending = add regex patterns or dataset examples, then make train.

Tests

107 tests: cryptography (tampering, reordering, wrong key), regex and ML guardrails on held-out sentences in FR and EN, API agent, MCP server, SDK client against a real uvicorn server (ephemeral port), real LLM agent (skipped if Ollama is absent — never simulated), OAuth2 JWT auth + rate limiting + DPO-ready PDF attestation + RFC 3161 anchoring against a real local TSA (incl. the insider chain-regeneration attack), and the full third-party verifier contract. Everything replays locally: make test re-trains both language models and runs the full suite.

Consuming AI-agent decisions in your own pipeline? Gate your builds on the integrity of the journal — the verifier ships as a GitHub Action (Marketplace):

- uses: slabbdev/noirebox-verify@v1
  with:
    export-path: export.json
    noirebox-ref: v0.5.0   # pin the verifier ref — reproducible audits

Roadmap

• OAuth2 (JWT bearer) + rate limiting — ADR 004
• PDF attestation export for DPOs — ADR 005
• Local LLM judge for doubtful cases — tier 2 of ADR 001
• RFC 3161 timestamping of the chain head — ADR 006/007, self-hosted TSA included
• Fleet anchoring (Merkle) — noirebox/merkle.py: one TSA seal covers N journals (Certificate-Transparency pattern); inclusion proofs are ~log2(N) hashes, verified offline — see make demo-fleet
• Reconciliation plugin v0 — invariants over the journal ("every decision must have an outcome"): noirebox/reconcile.py + CLI noirebox reconcile --fail-on-findings, schema from issue #3 (community request), pattern sketch in demo/demo_payout.py
• Fleet hub: scheduled aggregation of many instances (console, alerting)
• Multi-witness anchoring + auditor-pinned roots — NOIREBOX_TSA_PROFILES, egress allowlist, verifier/tsa_roots/ (ADR 008)
• OpenTimestamps witness — a Bitcoin-anchored receipt rides in the same anchor event (ADR 009)
• AI-Act vocabulary + audit-pack — art. 12(3) builders, noirebox audit-pack (ADR 010)
• Prometheus + Grafana metrics
• HSM/KMS private key migration (threat model)
• Product page rebuilt for GitHub Pages — premium dark landing in docs/, auto-deployed by .github/workflows/pages.yml (enable Pages → Source: GitHub Actions)

Support

NoireBox is free and MIT — verification included, forever. If it saved you time (or a compliance headache), a coffee is the best way to say it helps:

Scan or click — buymeacoffee.com/samlabbe

License

MIT — see LICENSE.