tokyntrail

Human oversight for AI agents · EU AI Act Art. 14 · ISO 42001 · GDPR

ai agents in production.
with approvals that survive any audit.

tokyn.trail holds every critical agent action, gets the right human to approve it, and turns that decision into tamper-evident proof. Integrated in 10 minutes without changing a line of agent code.

Start for freeView live demo

Free plan · no credit card · live in 10 minutes

  • Hosted in Frankfurt
  • GDPR-compliant, DPA included
  • Tamper-evident hash chain
  • Monitor mode: zero-risk trial

The problem

What actually kills agent projects in regulated markets.

01

88 %

of agent pilots never reach production — most die in the security or compliance review.

Source
02

> 50 %

of agents run without oversight or logging — a finding no auditor accepts.

Source
03

Art. 14

The EU AI Act demands effective human oversight — logs prove something happened. Not that a human answered for it.

EU AI Act Art. 14

tokyn.trail turns "we trust the agent" into "here is the proof of who approved what".

Compliance

Built for audits, not just demos.

What auditors, internal control and data protection officers ask — and what tokyn.trail answers:

"How do you ensure effective human oversight?"

EU AI Act Art. 14

Enforcement instead of convention: critical actions are physically held until an authorized human decides — regardless of model or framework.

"Can you evidence every decision, gap-free?"

ISO 42001 · internal audit

Every approval, rejection and rule change lands in a SHA-256 hash chain. Oversight report as PDF/CSV with the verification result — attach it to the audit as-is.

"Where does the data live, is there a DPA?"

GDPR Art. 28

Hosted exclusively in Frankfurt, encrypted at rest, DPA included, data export and deletion at any time. Never shared with third parties.

"Do critical operations follow the four-eyes principle?"

Internal control practice

Configurable per rule: two independent approvals, escalation chains with deadlines, role-based responsibility — all documented in the evidence.

No fantasy badges: we show what the product technically enforces — your audit produces the certificate list, not our marketing.

How it works

From blind spot to evidence in 10 minutes.

  1. 01

    Swap the URL — 10 minutes

    Point your MCP client at the tokyn.trail proxy URL. Monitor mode: nothing is blocked, but for the first time you see what your agents actually do.

  2. 02

    Toggle rules — one click per tool

    Allow, Approve or Deny — auto-generated from your tools, refined with conditions like "amount > €500" or "outside business hours".

  3. 03

    Decide & prove

    Approve in the inbox, via email link or SMS — decided in seconds, provable forever. The auditor report is one click.

Monitor mode blocks nothing and costs nothing — it just shows what your agents already do today. Most teams have no idea.

Invest 10 minutes now

The toolkit

Four tools. One goal: make responsibility provable.

01

Decide in seconds, not meetings

The inbox shows every open approval with context: arguments, rule, agent, deadline. Keyboard A/R/Enter. Your CFO decides via email link — no login.

02

Rules your team maintains itself

A triple switch per tool plus a visual condition builder from your tools’ schemas. New or changed tools require approval automatically — rug-pull protection included.

03

The right human, on their channel

Inbox, signed email links, SMS to verified numbers, Slack buttons. Escalation chains make sure nothing sits unanswered.

04

The report that passes the review

Oversight report with hash-chain verification on the cover, activity report with your enforce-readiness rate. PDF and CSV, one click or API.

Building an MCP server for your product?

Ship governance with it: the approval inbox as a web component or iframe inside your enterprise customers’ portal — white-label, origin-restricted, embedded in an hour. Exactly the argument your next enterprise deal needs.

Request the embedded program

Pricing

Starting is free. Staying is predictable..

Free for your first agent, Pro from €79/month. No credit card to start, cancel monthly, prices in euros.

free

0 €/month

200 Holds/month

pro

79 €/month

2,000 Holds/month

scale

390 €/month

20,000 Holds/month

See all plans

FAQ

The questions your security team will ask.

What happens if tokyn.trail goes down?
Monitor mode: fail-open — your agents keep running, only recording pauses. Enforce mode: fail-closed — no unchecked action gets through. You choose per connection.
Do you see my data?
Call arguments, yes — encrypted at rest, never shared, hosted in the EU. Self-hosted on request.
What about non-MCP agents?
The Hold API (REST) and the SDK cover LangGraph, n8n and custom builds: one POST, one decision, one webhook.
Do you replace a gateway?
No. tokyn.trail is the workflow and evidence layer between agent and execution — we complement gateways, not replace them.
How fast is the proxy?
p95 < 150 ms overhead for passed-through calls — enforced as a CI benchmark, not just claimed.
Is there a DPA?
Yes.

Your next security review is coming. The evidence can start today.

Swap the URL, watch monitor mode, pull the report — no risk, no credit card, no code changes.

Start for freeWatch the live demo first

Free plan · no credit card · live in 10 minutes