Quick Start

Integrate in under 30 minutes

curl -X POST https://api.veridion-nexus.eu/api/v1/shield/evaluate \
  -H "Authorization: Bearer ss_test_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "destination_country_code": "US",
    "data_categories": ["email", "name"],
    "partner_name": "OpenAI",
    "agent_id": "agt_your_agent_id",
    "agent_api_key": "agt_key_your_agent_api_key"
  }'

const { decision, reason, legal_basis } = response;

if (decision === 'BLOCK') {
  throw new Error(`Transfer blocked: ${reason}`);
}
if (decision === 'REVIEW') {
  await queueForHumanReview(transferId);
  return; // do not proceed
}
// decision === 'ALLOW' — proceed with transfer

Integration Patterns

Where does evaluate() fit?

Veridion Nexus works at your application's outbound layer — the point where your code calls an external API. You don't need to add it to every line of code. Add it once, to the wrapper function that calls your AI provider.

def call_openai(messages, user_data):
    # Evaluate before every external AI call
    shield = evaluate_transfer(
        agent_id="agt_your_agent_id",
        agent_api_key="agt_key_your_agent_api_key",
        destination_country_code="US",
        data_categories=["email", "name"],
        partner_name="OpenAI"
    )
    if shield["decision"] == "BLOCK":
        raise Exception("Transfer blocked")
    if shield["decision"] == "REVIEW":
        queue_for_review(shield["seal_id"])
        return None
    
    return openai.chat.completions.create(
        messages=messages
    )

from langchain_core.callbacks import BaseCallbackHandler

class SovereignShieldCallback(BaseCallbackHandler):
    def on_llm_start(self, serialized, prompts, **kwargs):
        result = evaluate_transfer(
            agent_id="agt_your_agent_id",
            agent_api_key="agt_key_your_agent_api_key",
            destination_country_code="US",
            data_categories=["email"],
            partner_name="OpenAI"
        )
        if result["decision"] == "BLOCK":
            raise BlockedTransferError(result["reason"])

# Add to your LLM
llm = ChatOpenAI(callbacks=[SovereignShieldCallback()])

const shieldMiddleware = async (req, res, next) => {
    const result = await shield.evaluate({
        agentId: 'agt_your_agent_id',
        agentApiKey: 'agt_key_your_agent_api_key',
        destinationCountryCode: 'US',
        dataCategories: req.body.dataCategories || [],
        partnerName: req.body.partnerName
    });
    
    if (result.decision === 'BLOCK') {
        return res.status(403).json({ 
            error: 'Transfer blocked', 
            reason: result.reason 
        });
    }
    
    req.shieldDecision = result;
    next();
};

app.use('/api/ai', shieldMiddleware);

Authentication

All API requests require a Bearer token in the Authorization header.

Authorization: Bearer ss_test_your_api_key

API keys start with ss_test_ for trial accounts and ss_live_ for Pro accounts.

Agent Registration

All evaluate() calls must originate from a registered agent. Sign in to the dashboard and open the Agents section before integrating the API.

Each registered agent receives:

• agent_id — unique identifier (format: agt_XXXXXXXX)
• agent_api_key — secret key shown once at registration (format: agt_key_XXXXXXXX)

Both are required on every evaluate() call alongside your tenant API key.

Quick registration steps

1. Sign in to the dashboard and open the Agents section
2. Click "Register New Agent"
3. Complete the 5-step wizard (identity, data policy, transfer policy, autonomy & oversight, review)
4. Copy your agent_id and agent_api_key — the key is shown only once

Evaluate Transfer

POST /api/v1/shield/evaluate

Evaluates a cross-border data transfer and returns a compliance decision with a cryptographically sealed evidence record.

Request body

Calls without agent_id and agent_api_key return 400 AGENT_REQUIRED. Register your agent in the dashboard before making your first transfer call.

Example request

{
  "source_system": "my-ai-agent",
  "destination_country_code": "US",
  "data_categories": ["financial"],
  "partner_name": "OpenAI",
  "agent_id": "agt_abc123def456",
  "agent_api_key": "agt_key_abc123..."
}

Example responses

{
  "decision": "ALLOW",
  "reason": "Germany is EU/EEA — no transfer restrictions",
  "legal_basis": [],
  "country_status": "eu_eea",
  "seal_id": "seal_a1b2c3d4e5f6...",
  "evidence_id": "evt_..."
}

{
  "decision": "ALLOW", 
  "reason": "Japan has EU adequacy decision",
  "legal_basis": ["GDPR Art. 45"],
  "country_status": "adequate_protection",
  "seal_id": "seal_...",
  "evidence_id": "evt_..."
}

{
  "decision": "REVIEW",
  "reason": "United States requires SCC — human review needed to verify safeguards",
  "legal_basis": ["GDPR Art. 46(2)(c)"],
  "country_status": "scc_required",
  "seal_id": "seal_...",
  "evidence_id": "evt_..."
}

{
  "decision": "BLOCK",
  "reason": "China blocked by organizational policy — GDPR does not prohibit transfers to a country by name; this product tier is not permitted",
  "legal_basis": ["GDPR Art. 44", "GDPR Art. 46"],
  "country_status": "blocked",
  "seal_id": "seal_...",
  "evidence_id": "evt_..."
}

Response Reference

Response fields

Decision logic

Error Codes

Error response format:

{
  "error": "unauthorized",
  "message": "Missing or invalid API key"
}

Shadow Mode

During your 30-day trial, your account starts in Shadow Mode.

Switch between modes in your dashboard under Settings.

Code Examples

# Evaluate a transfer to the US (OpenAI)
curl -X POST https://api.veridion-nexus.eu/api/v1/shield/evaluate \
  -H "Authorization: Bearer ss_test_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "destination_country_code": "US",
    "data_categories": ["email", "name"],
    "partner_name": "OpenAI",
    "agent_id": "agt_your_agent_id",
    "agent_api_key": "agt_key_your_agent_api_key"
  }'

# Evaluate a transfer to Germany (EU/EEA - always ALLOW)
curl -X POST https://api.veridion-nexus.eu/api/v1/shield/evaluate \
  -H "Authorization: Bearer ss_test_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "destination_country_code": "DE",
    "data_categories": ["email"],
    "partner_name": "AWS Frankfurt",
    "agent_id": "agt_your_agent_id",
    "agent_api_key": "agt_key_your_agent_api_key"
  }'

MCP Server

Veridion Nexus is available as an MCP (Model Context Protocol) server. This makes GDPR transfer evaluation available as a tool in Claude and Cursor workflows, without manual API integration.

Sovereign Shield — published as veridion-nexus-mcp. The evaluate_transfer tool requires agent_id and agent_api_key on every call. Accountability Ledger proxy — install veridion-nexus-gateway separately; it wraps an upstream MCP server and logs tool calls to the ledger (see below).

Setup: Claude Desktop

Sovereign Shield (install using npx): npx -y veridion-nexus-mcp

{
  "mcpServers": {
    "veridion-nexus": {
      "command": "npx",
      "args": ["-y", "veridion-nexus-mcp"],
      "env": {
        "VERIDION_NEXUS_API_KEY": "ss_test_your_key_here"
      }
    }
  }
}

File location: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)

Setup: Cursor

Sovereign Shield (install using npx): npx -y veridion-nexus-mcp

{
  "mcpServers": {
    "veridion-nexus": {
      "command": "npx",
      "args": ["-y", "veridion-nexus-mcp"],
      "env": {
        "VERIDION_NEXUS_API_KEY": "ss_test_your_key_here"
      }
    }
  }
}

File location: .cursor/mcp.json in your project root.

Available tools

The evaluate_transfer tool now requires agent_id and agent_api_key parameters on every call. Sign in to the dashboard and register your agent in the Agents section first.

Accountability Ledger

What is the Accountability Ledger

The Accountability Ledger is an MCP proxy that sits between your AI agents and upstream MCP servers. It intercepts every tool call, records it in a tamper-evident SHA-256 hash chain, and forwards the call only after logging succeeds — producing evidence suitable for EU AI Act Article 12 (record-keeping for high-risk AI systems) alongside your existing Sovereign Shield transfer checks.

How it works

1. Intercept — the proxy receives the tool call from the agent.
2. Hash — inputs/outputs are hashed (minimisation-friendly field lists where configured).
3. Log — an append-only record is written to the ledger with the previous entry hash.
4. Forward — the call is passed to the real MCP server and the response is logged.

Setup

Register your agent in the dashboard Agents section, then configure the MCP Governance Gateway (e.g. npx -y veridion-nexus-gateway in stdio mode) with:

What gets logged per tool call

EU AI Act Art. 12 compliance

Article 12 requires providers of high-risk AI systems to keep logs automatically generated by the system (to the extent such logs are under their control), in a way that ensures an appropriate level of traceability of the system's functioning throughout its lifetime. The Accountability Ledger supports this by creating immutable, time-ordered records of agent tool usage with cryptographic integrity — suitable as part of your technical documentation and audit evidence, alongside organisational measures and risk management.

Supported Annex III high-risk use-case categories (illustrative)

Hash-only vs full payload: by default the ledger stores hashes and field names (data minimisation). Full payload capture is not required for the hash chain; your DPA and logging policy should define any additional retention.

Viewing logs and generating reports

Open ACM Overview in the dashboard to review tool-call events, transfer annotations, and oversight items tied to your agents.

• Query the audit trail and filter by agent, time range, or decision
• Run hash-chain verification to prove log integrity end-to-end
• Export compliance bundles as JSON for auditors or your GRC tooling

Limitations

Veridion Nexus supports demonstrable compliance — it does not guarantee it. Understand these limitations before integrating:

Regulatory scope summary: Chapter V alignment is described in product documentation. Country classification lists are maintained in software and reviewed periodically — last reviewed: March 2026. Reconcile against EU Commission sources at least quarterly.