taskq.xyz / compliance
Compliance plane

AI audit evidence, not dashboard screenshots.

TaskQ turns every policy-bound AI request into exportable evidence: what ran, where it ran, which credential was used, which worker handled it, what was blocked, and whether the chain replays cleanly.

BLOCKED ATTEMPT RECEIPTREFUSED
request_idreq_77e
policymust_not_run_in: US
candidateworker_us_04
reasonjurisdiction rejected
executionnot attempted
✓ refusal recorded as proof
The rule

Do not claim compliance. Prove controls.

TaskQ should never pretend that software alone makes a customer compliant. The product provides enforceable controls and auditor-ready evidence for policy-bound AI execution.

Enforce — block before execution

Hard policy constraints are evaluated before a request reaches a worker. If no compliant capacity exists, TaskQ refuses with proof.

Record — every event becomes evidence

Placement decisions, credential access, blocked attempts, worker leases, usage, artifacts, and settlement all map into HashIQ entries.

Export — the customer leaves with proof

Chain segments, placement proofs, registry snapshots, anchor proofs, and report packages are exportable by design.

Policy enforcement

Compliance starts before the model sees a token.

The compliance plane turns customer defaults and request-level policy into release gates. Requests may tighten constraints. They may not loosen defaults.

GATE · RESIDENCY

Approved jurisdictions

Require execution in Canada, the EU, a customer-owned domain, or another approved jurisdiction.

GATE · EXCLUSIONS

Disallowed regions rejected

Explicitly reject workers in disallowed jurisdictions even when they are faster or cheaper.

GATE · CUSTODY

Credential boundaries

Restrict credential use to pinned, enclave, or customer-owned nodes.

GATE · TRUST

Worker tier floors

Require evidence, audited, or TEE worker tiers for sensitive workloads.

Audit report

The report should answer the questions buyers actually ask.

A serious compliance report is not a pretty chart. It has to show policies enforced, workers used, credentials accessed, chain status, exceptions, anchors, and settlement reconciliation.

Report contents

Scope plus verification.

  • Date range, tenant, environment, and matter reference.
  • Policies applied — and whether request policies tried to loosen defaults.
  • Workers used: jurisdictions, trust tiers, custody classes.
  • Credential fingerprints, access events, rotations, revocations.
  • Blocked attempts, exceptions, retries, capacity refusals.
HashIQ chain continuityverified
signature verificationpassed
placement replayno cheaper skipped
registry snapshot validityat placement time
external anchor rangewitnessed
settlement journal parityreconciled
resultREPORT_VERIFICATION_PASSED
Residency evidence

Where work ran must be visible after the fact.

TaskQ records effective worker attributes at the time of placement. An auditor needs the state at execution time, not today’s dashboard state.

SurfaceWhat the report shows
Worker refBlinded or disclosed based on report scope and customer permissions.
JurisdictionEffective execution location, residency class, and excluded regions.
AttestationTier, evidence reference, expiry status, and weakest-link calculation.
SnapshotRegistry snapshot proof used for placement replay.
Compliance API

Evidence should be queryable.

The compliance surface needs to feel operational: lookup, report, export, verify, and inspect credential access.

compliance API — report outcome
GET /v1/chain/{request_id}
GET /v1/chain/export?from=2026-06-01&to=2026-06-30
GET /v1/reports/audit?environment=prod
GET /v1/credentials/{credential_id}/access

# report outcome
{
  "chain_verification": "passed",
  "anchor_verification": "passed",
  "placement_replay": "passed",
  "blocked_attempts": 17,
  "settlement_reconciled": true
}

Give auditors evidence they can replay.

Policy enforcement. Credential access logs. Placement proof. Chain anchors. Exportable reports.