Your engineers run AI agents against ledger logic, payment flows and account data, and an auditor will eventually ask what those agents actually did. Beam records the activity locally and gives you an evidence trail to hand over, without asserting a compliance certification it hasn't earned.
Beam produces evidence a reviewer can read. It does not attest to SOX, PCI DSS or any other framework on your behalf.
Same event record every solution reads from, framed for the questions a financial-services audit or risk review tends to ask.
Evidence
Commands, file writes and tool calls against project_path and, where instrumented, the destination host — not a summary someone has to trust.
Supply chain
Eleven heuristic patterns plus a version-pin check, run before a server connecting to real systems gets approved.
Data handling
API keys, tokens and auth headers are stripped before persistence. This is credential redaction, not a data-loss-prevention scan for account numbers or PII — treat exports accordingly.
Review
Flagged actions can be marked reviewed, and that review survives a restart — the difference between a log and something an auditor can sign off on.
Export
Event, scan and review files bundled with SHA-256 hashes, so what you hand over is internally consistent.
01
A hook merged into settings plus a local service — nothing installed silently, nothing enforced.
02
Get a real record of what your agents did before the next audit, instead of reconstructing it from memory.
03
A redacted NDJSON export or a hashed case bundle — you decide what leaves the machine and when.
No. Beam produces evidence — a record of what an AI agent did — that a compliance program can use as one input. It doesn't attest to any control or framework, and treating it as a certification would misrepresent what it does.
No. Beam redacts known credential formats (API keys, tokens, auth headers) before writing an event to disk. It does not scan for account numbers, PII or other regulated data — review an export before sharing it outside your team.
Not in v1. Beam observes and alerts; it emits no allow/deny response and cannot block a command. If you need enforcement today, Beam is not that tool yet.
On the machine that generated it. The collector binds to 127.0.0.1:4319 and writes local files at 0700/0600. Nothing leaves unless someone runs an export.
Instrument a handful of machines and see what your agents actually did — evidence, not a promise.