I built a tamper-proof AI audit trail API in 14 days from Indonesia. 72 days until EU AI Act. Here's what I learned.
I'm 18, based in Bandung, Indonesia. I built AIDAL — an API that logs every AI decision with a SHA-256 hash chain, plain-English explanation, and automatic compliance checking for EU AI Act, MAS FEAT, OJK, and VARA.
The whole thing took 14 days. FastAPI on Railway, PostgreSQL, Groq for AI explanations, GPG-signed daily anchors published to GitHub.
What it does in one API call:
Creates a tamper-proof hash chain — any tampering is mathematically detectable
Generates a plain-English explanation of the decision
Checks compliance against the relevant regulator's requirements
Returns a public verify URL any regulator can check without logging in
What I got right:
Starting with the infrastructure problem, not the legal problem. Everyone else is selling compliance documents. I built the thing that makes the documents provable.
What I got wrong:
Underestimating how hard it is to reach compliance officers. Developers find me easily. The person who actually needs this — the CCO at a Singapore fintech is much harder to get in front of.
Where I am now:
0 paying customers. Several warm conversations. 72 days until the EU AI Act deadline that makes this mandatory.
Free during beta: tryaidal.github.io/landing_page_aidal
Honest feedback welcome — especially if you've sold B2B compliance tools before.
This is a strong wedge because you’re not just selling “AI compliance.” You’re solving the infrastructure problem underneath compliance: can a company prove what the AI decided, why it decided it, when it happened, and whether the record was tampered with later.
That matters a lot for the buyer you’re struggling to reach. A developer may understand the hash chain, but a compliance officer cares about auditability, regulator confidence, and reducing personal/business risk before deadlines hit. I’d make the CCO-facing message less about the API build and more about “provable AI decision records before the regulator asks.”
The naming also matters here. AIDAL is understandable, but it still sounds like another AI tool. If this becomes serious audit-trail infrastructure for fintech, health, insurance, or regulated AI systems, Davoq.com would feel more durable and enterprise-grade for that trust layer.