Witness anywhere — what leaves your walls
Witnessing proves a capsule was included in a public, append-only log. The only thing that travels to the log is a digest (a hash) and a timestamp — never your prompts, payloads, reasoning, or PII.
What leaves your walls
A capsule is content-private by construction: it carries digests of inputs and outputs, not the raw values. When it's witnessed, the log receives the statement's commitment — a hash — plus a timestamp. The raw content stays where you keep it, under your control. The public log stores a commitment you can check, not your data.
Witness anywhere — three options
| Where you witness | What it gives you | What leaves your environment |
|---|---|---|
| The public log | zero-setup existence proofs on a shared, open log (anchor.agentactioncapsule.org) | a digest + a timestamp |
| Your own witness, in the region you choose | residency / jurisdiction control (e.g. EU, Singapore) by running the open witness log where you need it | a digest + a timestamp, kept in your jurisdiction |
| Your own witness, inside your VPC | full control — self-host the container with your own storage | nothing — the hash never leaves your environment |
The capsule is witness-agnostic (it makes no claim about the log's verifiable-data-structure): the same statement verifies whichever log you choose, so you can move or mix witnesses without changing the record. This is also true of vendor lock-in more broadly: no vendor, including us, controls where your capsules get witnessed.
What a digest hides — and what it doesn't
A digest hides a value only when that value is hard to guess. A high-entropy input (a full prompt, a document, a key) is safe. But a low-entropy value — a short dollar amount, a yes/no disposition, an ID from a known list — can be recovered by hashing candidate values until one matches. For those fields, salt before hashing (commit a per-tenant salt alongside the value) so the digest can't be brute-forced. And note the capsule commits some metadata in the clear — the action type and disposition — so “content-private” means your payloads stay private, not that the capsule reveals nothing about what kind of action occurred.