Trust Center

SEC Rule 17a-4 — Overview

SEC Rule 17a-4 (17 C.F.R. § 240.17a-4) establishes electronic record-keeping obligations for broker-dealers and financial intermediaries. The rule requires that covered records be preserved in a non-rewriteable, non-erasable format — commonly referred to as WORM (Write Once, Read Many) storage — for defined retention periods, with immediate availability for regulatory examination.

The four operative requirements are:

1. WORM format — records may not be altered or erased after commit.
2. Retention periods — most records: 6 years total, 3 years in immediately accessible form.
3. Designated third-party access — an independent custodian must be able to furnish records on regulatory demand.
4. Regulatory examination access — records must be produced promptly on request from the SEC or FINRA.

The TrueTime Ledger

The TrueTime Ledger is Vantio's append-only audit trail operating at the kernel boundary. Every AI-initiated syscall intercepted by the Vantio eBPF layer is serialized into an immutable ledger entry before the call is permitted to proceed. No entry may be modified or removed after it has been committed.

Each ledger record contains:

• Kernel-monotonic timestamp (nanosecond resolution)
• Process credential set (UID, GID, PID, cgroup ancestry)
• Syscall identifier and normalized argument vector
• Enforcement decision (permit / block / quarantine)
• RISC Zero zkVM proof of record integrity (Poseidon2 Merkle root)

The zkVM proof allows any party with the Vantio verifier key to independently confirm that a record has not been altered since the moment of capture — satisfying the third-party verification requirement of 17a-4 without requiring access to Vantio infrastructure.

Bifurcated Deployment — SOVEREIGN_MODE

The Vantio daemon resolves its ledger backend at process start from theSOVEREIGN_MODE environment variable. Both code paths preserve identical WORM semantics (append-only, no in-place mutation, zk-proof-anchored); they differ only in storage substrate and external dependency surface.

• Cloud-Native (default, SOVEREIGN_MODE=false): records are committed to the GCP Spanner phantom_deltas table via single-rowinsert mutations against a TIMESTAMP allow_commit_timestampcolumn. Multi-region TrueTime guarantees external consistency across replicas.
• Sovereign / Air-Gapped (SOVEREIGN_MODE=true): the daemon bypasses GCP entirely and appends each event as a single JSON line to a localized WORM ledger at /var/log/vantio/ledger.worm, opened withOpenOptions::append(true). Periodic external block-header anchoring provides third-party verifiability without any outbound network egress, satisfying the data-sovereignty requirements of isolated-VPC and classified deployments.