Observability helps engineers debug. GRC platforms track checklists. AI governance manages policy. None of them can prove to an auditor what an agent actually did. That’s the one job Runfile does.
If you already use one of these, keep it. Here’s what each is built for, and the one question only Runfile answers.
“Why is my agent slow, or wrong?”
(trace_id, span_id, input, output, latency)Best-in-class for engineering: traces, evals, prompt iteration, latency hunts. Default retention is 14–15 days. The logs are mutable, billed by span volume, and untouched by control mapping. Keep them; Runfile reads OTel and rides alongside.
“Are our controls in place?”
(control_id, evidence_artifact, owner, status)Vanta hit $300M ARR in April 2026; Drata is at $100M; OneTrust at half a billion. They are excellent at SOC 2 evidence rooms and the policy and inventory layer. They do not model the agent run. Runfile feeds them, not the other way around.
“Do we have the right AI policies?”
Credo AI’s “Agent Registry”, Holistic’s bias and red-team toolkits and ValidMind’s bank-MRM evidence are real and useful. They generate audit artefacts at the policy layer. The agent execution graph is not their object.
“What exactly did this agent do, and can you prove it?”
The actual sequence of prompts, tools, retrievals, refusals and approvals, kept as a first-class, tamper-evident audit object. That’s the one thing none of the others ship today.
Nothing to rip out. Runfile reads the same OpenTelemetry data your observability tool already gets, and sends evidence on to your compliance platform.
Eight questions that come up in every AI audit. Pick one to see how each kind of tool answers it.
| Auditor question | Developer observabilityDatadog · Langfuse · LangSmith · Arize | GRC platformsVanta · Drata · OneTrust | AI governanceCredo AI · Holistic AI · ValidMind | Runfile |
|---|---|---|---|---|
| Can you show everything the agent did, step by step? | Partly Traces of each step, but usually kept for only about 14 days. | No Doesn’t record agent runs at all. | Partly Describes the policy, not what actually happened in the run. | Yes The full execution graph: every prompt, tool call, retrieval and approval. |
| Can you prove nobody has changed the record? | No Logs can be edited or deleted without a trace. | No Records are editable. | No Records are editable. | Yes Every event is hash-chained, signed and anchored to a public log. |
| Can you link each event to the rule it satisfies? | No No link between events and controls. | Partly Tracks controls as checklist items, not the events behind them. | Partly Maps policies, not individual events. | Yes Each event is mapped to the control it satisfies. |
| Can you keep records for six months to ten years? | No Default retention is about 14 days. | Partly Keeps documents, not event records. | Partly Keeps documents, not event records. | Yes Tiered retention on locked storage (S3 Object Lock). |
| Can an outsider check it without trusting you? | No No independent verification. | No No independent verification. | No No independent verification. | Yes An offline verifier plus a public anchor that anyone can check. |
| Can you hand the auditor one complete package? | No Dashboards, not deliverables. | Partly Evidence rooms, built for SOC 2. | Partly Policy reports. | Yes A signed PDF, the raw event log and a verifier, in one package. |
| Can the data stay in the EU, UK or US? | Yes Regional hosting is available. | Yes Regional hosting is available. | Partly Regional coverage is patchy. | Yes From day one, single-tenant, in your region. |
| Does the price stay predictable as usage grows? | No Billed per span or per GB, so costs climb with traffic. | Yes Priced per seat or per framework. | Yes Priced per framework. | Yes Per execution, plus a retention tier. |
| Who buys it | Platform Eng | CISO · Compliance | Head of AI Governance | CCO + Internal Audit |
We’d rather point you to the right tool than sell you the wrong one.
You’re a consumer app with no regulated workload and no contractual evidence obligations.
You need real-time guardrails that block a bad output before it leaves the model.
You need a SOC 2 evidence room and policy library, with no agents in scope yet.
If none of these regulations are within twelve months of you, the case for Runfile is weaker. Buy a good observability tool, ship your product, and come back when the auditor calls.
We’ll do a 30-minute walk-through with whoever signs off your model risk programme. If they have an obvious objection, we’d like to hear it.