LIVE DEMO // SANDBOX READY
See the moving target
in motion.
Watch Ghost Protocol rotate endpoints in under 30 seconds. Every rotation is hardware-attested, SHA-256 signed, and broadcast to an authenticated peer set. No fixed address. No predictable pattern.
$aetherctl --rotate ghost-protocol[boot] seeding entropy from quantum-tap :: 4.8 Mbps[boot] commitment vector generated :: SHA-256[net] dropping stable endpoint 10.0.12.4[ok] new endpoint 10.0.12.7 :: ttl=24s signed[ok] rotation window active :: 142 peers acknowledged$aetherctl --verify[ok] hardware attestation :: TPM 2.0 quote valid[ok] moving target armed$
Three Pillars of Proof
What makes a receipt tamper-evident
Every output is cryptographically sealed the moment it leaves the model. Change one byte and the entire signature breaks. Here is exactly how that works.
SHA-256 Content Signing
Every AI output is hashed with SHA-256 at the moment of generation. The resulting digest is unique to that exact content -- alter a single character and the hash changes completely, instantly revealing tampering.
Quantum-Seeded Entropy
JWT signing keys are generated from quantum random number generators, not pseudorandom software. This eliminates seed prediction attacks and ensures every token is cryptographically unique and unguessable.
Tamper-Evident Receipts
The signed receipt bundles the content hash, an independent timestamp from a third-party authority, and the quantum-seeded JWT into a single verifiable artifact. Anyone can check it; nobody can forge it.
Live Signing
Paste any AI output and sign it now
No account needed. Paste any text into the signing field, click Sign, and get back a tamper-evident receipt with a SHA-256 hash, independent timestamp, and quantum-seeded JWT -- all verifiable with a single command.
# Step 1: Download the receipt
$ aetherctl receipt download --id rec_7x9kLm
# Step 2: Verify the SHA-256 hash
$ aetherctl verify hash receipt.json
Content hash: a7f3c...d9e1b
Status: MATCH
# Step 3: Confirm timestamp authority
$ aetherctl verify timestamp receipt.json
Authority: DigiCert TSA
Signed at: 2026-04-15T09:41:22Z
# Step 4: Validate JWT signature
$ aetherctl verify jwt receipt.json
Algorithm: ES256
Signature: VALID
Verification Flow
Verify any receipt with aetherctl
Auditors do not need to trust AetherCloud. They download the receipt, verify the hash matches the content, confirm the timestamp against the independent authority, and validate the JWT signature. Three commands, zero trust required.
- 1
Verify the SHA-256 hash -- confirms content has not been modified since signing
- 2
Confirm timestamp authority -- proves when the receipt was created via third-party TSA
- 3
Validate the JWT signature -- ensures the receipt was issued by a legitimate AetherCloud key
Inside the Rotation Process
A visual walkthrough of how AetherCloud rotates endpoints, signs outputs, and delivers tamper-evident proof at every step.
The AetherCloud agent initiates the signing sequence
Quantum-seeded entropy drives endpoint rotation
Hardware attestation validates the signing environment
Ghost Proxy ensures zero-visibility data transit
The cryptographic receipt is sealed and delivered
Verification completes the chain of trust
Demo FAQ
Common questions about signed receipts, verification, and how the demo works.
What goes into a signed receipt?
Every receipt contains a SHA-256 hash of the AI output, an independent timestamp from a third-party authority, and a quantum-seeded JWT that rotates every fifteen minutes. Together they form an unforgeable proof of what was generated and when.
How is this different from a log file?
Logs can be edited, backdated, or deleted after the fact. A signed receipt cannot be modified because any change breaks the cryptographic signature. The proof is mathematical, not procedural.
Can an auditor verify this independently?
Yes. The hash, timestamp, and JWT signature are all independently verifiable using aetherctl or standard cryptographic tools. No trust in AetherCloud is required -- the math speaks for itself.
Does this satisfy compliance requirements?
Signed receipts satisfy audit trail requirements for SOC 2 Type II, HIPAA, and the EU AI Act because the proof is cryptographic, not based on self-reported controls. Auditors verify the math directly.
Is my data safe during the demo?
The demo runs entirely in your browser. In production, Ghost Proxy ensures AetherCloud never sees your content -- signing happens inside your isolated vault with your keys, so your data never leaves your control.
How often do signing keys rotate?
Quantum-seeded signing keys rotate every fifteen minutes by default. Each rotation uses fresh entropy from our quantum random number generator, making key prediction mathematically impossible even with advance knowledge of prior keys.
Want the full technical breakdown?
Read our documentation for protocol specs, SDK guides, and architecture deep dives.
Ready to prove every decision?
Start generating tamper-evident receipts for your AI outputs today. Starter plan includes 1,000 signed receipts per month.