Eudora

Inspiration

Financial services firms deploy AI agents to automate high-stakes decisions: loan approvals, fraud flags, trade recommendations. But regulators -- DORA Article 11 in the EU, and emerging SEC guidance in the US -- require firms to prove their AI systems behaved as intended, at any point in time. Today that proof does not exist. Log files are mutable. Vendors are opaque. Legal teams have no way to verify what an AI agent actually did.

We built Eudora because we believe every AI deployment in a regulated industry deserves a tamper-evident paper trail.

What it does

Eudora is an AI governance and compliance platform. It connects to any AI agent through a lightweight SDK, intercepts every interaction, and generates cryptographically verifiable compliance reports.

Core capabilities:

Nexus Audit: an append-only tamper-evident audit log. Every agent interaction is hashed and chained so no entry can be modified after the fact.
Scope violation detection: a real-time classifier that flags when an agent is asked to operate outside its defined boundaries, with a 0-100 risk score and automatic SCOPE_VIOLATION tagging.
RFC 3161 compliance reports: one-click PDF reports with a cryptographic timestamp issued by a trusted timestamp authority. The timestamp is mathematically bound to the report content. If anyone modifies the PDF, verification fails.
DORA Article 11 alignment: reports structured to meet EU Digital Operational Resilience Act documentation requirements for AI systems in financial services.

How we built it

Eudora runs on a Node.js/Fastify backend with a React frontend. We use PostgreSQL on Railway for persistence.

The Qwen Cloud integration is central to how Eudora works. Rather than building yet another LLM, we used the Qwen qwen-plus model via Alibaba Cloud Model Studio's OpenAI-compatible API. Our "Neural Interface" (the chat UI) routes all messages through the Eudora SDK, which logs each interaction to the Nexus Audit before passing it to Qwen.

For RFC 3161 timestamps, we implemented a client that submits a SHA-256 hash of the report content to Freetsa.org, a public timestamp authority, and stores the returned token with the report. Verification reconstructs the hash from the stored PDF and checks it against the token.

The scope violation classifier runs on every inbound message and scores it against the agent's defined scope. A procurement agent that receives a request for investment advice should trigger a violation -- and it does.

Challenges

The hardest part was making the tamper-evidence actually trustworthy. A PDF that claims to be immutable is not immutable. We needed the timestamp to be mathematically bound to the content, so we strip metadata before hashing and store the raw content hash, not the full file. Any byte-level modification to the report fails verification.

The second challenge was scope classification, building a classifier that catches out-of-scope requests reliably without blocking legitimate edge cases.

What we learned

Qwen Cloud's OpenAI-compatible API made the integration far faster than expected. The qwen-plus model handles complex procurement and compliance reasoning well, and the response quality on domain-specific tasks is strong.

We also learned that the compliance use case is genuinely underserved. The moment you can hand a bank's legal team a PDF with a cryptographic timestamp and say "here is proof your AI behaved correctly" - that changes the conversation entirely.