Incident evidence infrastructure · three modules
Three questions.
Two are answerable today.
Signum Causa sits in your Slack or Teams incident channel, seals what was said, and writes it onto your ITSM ticket with every claim traced back to the message it came from — evidence of what happened, made while it happened. Custos turns that same record into proof a control operated. Memoria keeps what the organisation knows, and answers in plain language.
You hold whichever parts you need; a part you do not hold is absent from your console, not dangled in front of you.
- What happened, and why?
The hour reconstructed from what was actually said, not from what anyone remembered afterwards.
- Can we show the control operated?
A different reader asks this, on a different clock: risk and compliance, long after the channel went quiet.
- What do we already know about this?
Asking is not searching. Memoria holds a standing index of the places your knowledge already lives, and answers from memory it already has — in plain language, with the page it came from.
“Says who?” Every answer above carries the message ids it came from, on a transcript you can re-hash yourself.
The proof
Verify a seal yourself.
This is the product’s own claim-to-source component, running on this page rather than a screenshot of it. Open a claim and the messages behind it unfold. One claim is deliberately ungrounded, and flagged as such. Press Verify this seal and your browser recomputes the hash.
The problem
The record dies in the channel.
An incident is resolved in conversation and closed in a ticket, and the two never meet. The ticket says what happened; the channel knows why, who decided it and what was ruled out. Three years later a regulator asks, and the answer is somebody’s memory — if that person still works here.
Reconstruction is expensive
Assembling a defensible account after the fact costs days of senior time, and produces something weaker than a contemporaneous record.
Evidence assembled later is not evidence
A trail written at the moment an action happened carries weight. One reconstructed months afterwards invites the question of what was left out.
AI summaries make it worse
A plausible narrative with no link back to what was actually said is not something you can put in front of an auditor.
Fits what you already run
Vendor-agnostic by architecture.
The core speaks in domain types and never imports a vendor SDK, so swapping a platform is configuration rather than a migration. Slack and Teams; ServiceNow, FreshService, BMC Helix and Ivanti; Anthropic, OpenAI, Gemini or any OpenAI-compatible endpoint you already run.
Boundaries
What Signum does not do.
Stated plainly, because a control you cannot describe is a control nobody can rely on.
- Causa does not become your system of record. Everything it produces is written back to the ITSM ticket. There is no Signum data lake holding your incidents. The single exception is a ticket whose attachment limit is full: rather than delete an earlier revision to make room — which would destroy the only copy of a message since edited or deleted in Slack — the remaining revisions are kept in Signum for reference, and the ticket says so on its face.
- Memoria does not take custody of your knowledge. The pages are Markdown in a Git repository you own. What Signum keeps is an index derived from them, and that index is rebuildable: clone the repository, run a sync, and it is reconstructed. Delete our copy and you have lost a cache, not a corpus.
- It does not run a model continuously. Extraction happens on demand, at ticket close, and at month end — not on a loop spending tokens on incidents nobody will read.
- It does not send personal data to a model by default. Personal data, secrets and market-sensitive phrases are suppressed before the transcript leaves your boundary, and the suppression fails closed.
- It does not publish anything on its own. Knowledge articles, problem links and customer notices are proposed. A named human decides.
- It does not notify a regulator. Signum computes the clock and reports elapsed or due. Notification is a human act, deliberately.
Why I built this
A letter, not a testimonial.
I have spent twenty-five years accountable for live service — shop-floor ERP, twenty-four-hour service desks built from nothing, and latterly FCA-regulated digital-asset custody, where every incident eventually meets somebody whose job is to ask what you knew and when.
The honest answer was too often a reconstruction. The channel where the work actually happened had scrolled away, and what survived was a ticket with a resolution code and a summary written by whoever was least tired.
Signum is the tool I wanted on those incidents: something that captures the conversation as it happens, seals it so nobody has to take my word for it, and refuses to assert anything it cannot point at. Pre-launch, there are no customer logos on this page for the same reason there are no invented numbers. What is here is the product.
Aasim Saeed · founder
Bring your own incident.
Thirty minutes against your stack — your channel, your ticket, the questions your regulator actually asks.