ProlixoTech Documentation

CPCSC Readiness Documentation

Why ProlixoTech?

Not all evidence is created equal. Here's what makes ProlixoTech different from regular logging — and why enterprises choose it for defensibility.

Installation

Requires Python 3.9 or higher. Choose your operating system:

pip3 install solymus

python3 -c "import solymus; print('Success!')"

py -m pip install solymus

py -c "import solymus; print('Success!')"

Get Your API Credentials

1. Sign up at prolixotech.com/signup.html
2. Verify your email address
3. Log in to the dashboard
4. Copy your Tenant ID and API Key from the dashboard

Quick Start

Get started with ProlixoTech in three steps:

1. Initialize the Client

from solymus import Solymus

# Initialize with endpoint, tenant_id, and API key
client = Solymus(
    endpoint="https://api.prolixotech.com",
    tenant_id="my-company",
    api_key="YOUR_API_KEY"
)

2. Fire-and-Forget (Non-blocking)

# Non-blocking - events queued and sent in background
event_id = client.record("model_inference", {
    "model": "gpt-4",
    "prompt": "What is AI?",
    "response": "AI is...",
    "tokens": 150
})
# Returns immediately with event_id
print(f"Queued: {event_id}")

3. Synchronous (Blocking, Returns Receipt)

# Synchronous - waits for server confirmation
receipt = client.record_sync("critical_decision", {
    "decision_type": "loan_approval",
    "outcome": "approved",
    "confidence": 0.95
})

# Receipt is a dataclass with these attributes:
print(f"Event ID: {receipt.event_id}")      # Unique identifier
print(f"OK: {receipt.ok}")                  # True if successful
print(f"Trace ID: {receipt.trace_id}")      # Correlation ID
print(f"Digest: {receipt.digest_b64url}")   # SHA-256 digest
print(f"Algorithm: {receipt.signing_alg}") # ECDSA_SHA_256

How Your Data Flows

When you call record() from the SDK or POST /ingest via REST, here is exactly what happens inside ProlixoTech's infrastructure:

Step-by-Step

What the receipt proves

When you call record_sync(), the receipt you get back contains:

This receipt is your cryptographic proof that the evidence existed in this exact form at the recorded timestamp. Assessors and auditors can verify it independently via GET /verify/{event_id} or the public verification URL in your exports.

5-Minute Demo

Test ProlixoTech with or without an AI provider. Choose an option below.

Option 1: Quick Test (No AI Required)

Test ProlixoTech without any AI provider. Only needs your ProlixoTech credentials.

Step 1: Get ProlixoTech Credentials

1. Go to your Dashboard
2. Copy your Tenant ID (shown on dashboard)
3. Click "Generate API Key" and copy the key

Step 2: Create test.py

Open Notepad, paste this code, replace your credentials, and save as test.py on Desktop:

from solymus import Solymus
TENANT_ID = "your-tenant-id"
API_KEY = "ak_live_your_key_here"
log = Solymus(endpoint="https://api.prolixotech.com", tenant_id=TENANT_ID, api_key=API_KEY)
receipt = log.record_sync("test_event", {"message": "Hello from Solymus!", "demo": True})
print(f"Event ID: {receipt.event_id}")
result = log.verify(receipt.event_id)
print(f"KMS Signature Valid: {result.kms_signature_valid}")

Step 3: Run

Windows:

cd Desktop
py test.py

Mac / Linux:

cd ~/Desktop
python3 test.py

Event ID: 3832bcb3-daea-4a9c-a198-96a249107f51
KMS Signature Valid: True

Option 2: Full Demo with AI

Test with a real AI provider. Choose one below.

Step 1: Install AI Package

Windows:

py -m pip install google-genai

Mac / Linux:

pip3 install google-genai

Step 2: Get API Keys

• Gemini API Key (Free): aistudio.google.com/apikey
• ProlixoTech Credentials: Your Dashboard

Step 3: Create demo.py

Open Notepad, paste this code, replace your 3 credentials, save as demo.py on Desktop:

from google import genai
from solymus import Solymus
GEMINI_KEY = "AIza..."
TENANT_ID = "your-tenant-id"
API_KEY = "ak_live_..."
client = genai.Client(api_key=GEMINI_KEY)
log = Solymus(endpoint="https://api.prolixotech.com", tenant_id=TENANT_ID, api_key=API_KEY)
response = client.models.generate_content(model="gemini-2.0-flash", contents="What is AI?")
print(f"Gemini: {response.text}")
receipt = log.record_sync("gemini_inference", {"model": "gemini-2.0-flash", "output": response.text})
print(f"Event ID: {receipt.event_id}")
result = log.verify(receipt.event_id)
print(f"KMS Signature Valid: {result.kms_signature_valid}")

Step 4: Run

Windows:

cd Desktop
py demo.py

Mac / Linux:

cd ~/Desktop
python3 demo.py

Gemini: Artificial intelligence (AI) refers to...
Event ID: 4a719f94-27eb-4a24-a36b-bfec34977a1d
KMS Signature Valid: True

Other AI Providers

Groq (Free, Recommended)

Install: py -m pip install groq (Windows) or pip3 install groq (Mac/Linux)

Get key: console.groq.com/keys (free, no credit card)

from groq import Groq
from solymus import Solymus
GROQ_KEY = "gsk_..."
TENANT_ID = "your-tenant-id"
API_KEY = "ak_live_..."
client = Groq(api_key=GROQ_KEY)
log = Solymus(endpoint="https://api.prolixotech.com", tenant_id=TENANT_ID, api_key=API_KEY)
response = client.chat.completions.create(model="llama-3.1-8b-instant", messages=[{"role": "user", "content": "What is AI?"}])
print(f"Groq: {response.choices[0].message.content}")
receipt = log.record_sync("groq_inference", {"model": "llama-3.1-8b-instant", "output": response.choices[0].message.content})
print(f"Event ID: {receipt.event_id}")
print(f"KMS Signature Valid: {log.verify(receipt.event_id).kms_signature_valid}")

Groq: Artificial Intelligence (AI) refers to the development of computer systems...
Event ID: 202c2e2a-e224-4740-9efb-0ab433f0441b
KMS Signature Valid: True

OpenAI (GPT-4, GPT-3.5)

Install: py -m pip install openai (Windows) or pip3 install openai (Mac/Linux)

Get key: platform.openai.com/api-keys

from openai import OpenAI
from solymus import Solymus
OPENAI_KEY = "sk-..."
TENANT_ID = "your-tenant-id"
API_KEY = "ak_live_..."
client = OpenAI(api_key=OPENAI_KEY)
log = Solymus(endpoint="https://api.prolixotech.com", tenant_id=TENANT_ID, api_key=API_KEY)
response = client.chat.completions.create(model="gpt-3.5-turbo", messages=[{"role": "user", "content": "What is AI?"}])
print(f"GPT: {response.choices[0].message.content}")
receipt = log.record_sync("openai_inference", {"model": "gpt-3.5-turbo", "output": response.choices[0].message.content})
print(f"Event ID: {receipt.event_id}")
print(f"KMS Signature Valid: {log.verify(receipt.event_id).kms_signature_valid}")

Anthropic Claude

Install: py -m pip install anthropic (Windows) or pip3 install anthropic (Mac/Linux)

Get key: console.anthropic.com/settings/keys

from anthropic import Anthropic
from solymus import Solymus
ANTHROPIC_KEY = "sk-ant-..."
TENANT_ID = "your-tenant-id"
API_KEY = "ak_live_..."
client = Anthropic(api_key=ANTHROPIC_KEY)
log = Solymus(endpoint="https://api.prolixotech.com", tenant_id=TENANT_ID, api_key=API_KEY)
response = client.messages.create(model="claude-3-haiku-20240307", max_tokens=1024, messages=[{"role": "user", "content": "What is AI?"}])
print(f"Claude: {response.content[0].text}")
receipt = log.record_sync("claude_inference", {"model": "claude-3-haiku", "output": response.content[0].text})
print(f"Event ID: {receipt.event_id}")
print(f"KMS Signature Valid: {log.verify(receipt.event_id).kms_signature_valid}")

Configuration

Configure ProlixoTech via constructor arguments or environment variables:

ProlixoTech Client

Constructor

Solymus(
    endpoint: str,                         # Required: API endpoint URL
    tenant_id: str = "default",           # Your tenant identifier
    api_key: str = None,                  # API key for authentication
    batch_size: int = 10,                 # Events per batch
    flush_interval: float = 5.0,         # Seconds between flushes
    max_queue_size: int = 1000,          # Max queue before blocking
    timeout: int = 10                     # HTTP timeout in seconds
)

Methods

record(event_type, payload, ...) - Fire-and-forget. Returns event_id immediately.

record_sync(event_type, payload, ...) - Synchronous. Returns Receipt object.

verify(event_id) - Verify evidence. Returns VerificationResult.

flush() - Force flush all queued events.

close() - Gracefully shutdown, flushing remaining events.

Receipt Object

Returned by record_sync():

VerificationResult Object

Returned by verify():

Compliance Schema

The SDK uses structured dataclasses to represent compliance evidence. Built-in field validation ensures your data is correct before it reaches our servers.

Core Objects

ContextRegistry

Bundles all evidence-related metadata (system ID, audit trails, lineage, etc.):

Evidence Types (Auto-Mapping)

Complete Evidence Example

Here's a full compliance event demonstrating all supported fields:

from solymus import (
    Solymus, ContextRegistry, ModelContext, SessionContext,
    PerformanceMetrics, PolicyContext, DataProvenance, HumanIntervention
)

client = Solymus(
    endpoint="https://api.prolixotech.com",
    tenant_id="defence-supplier-123",
    api_key="ak_live_your_key"
)

# ITSP.10.171 — System Identification
model_ctx = ModelContext(
    system_id="classified-system-alpha",
    deployment_env="production",
    version="2.4.1"
)

# Audit Trail
session_ctx = SessionContext(
    user_id="user@defence-supplier.ca",
    session_id="sess_xyz123",
    action="approved_procurement",
    timestamp="2026-03-14T14:22:35Z"
)

# Evidence Lineage
provenance = DataProvenance(
    source_system="ServiceNow",
    data_classification="PROTECTED B",
    lineage_hash="sha256:abc123..."
)

# Authorization Records
oversight = HumanIntervention(
    approver_id="supervisor@defence-supplier.ca",
    approval_timestamp="2026-03-14T14:30:00Z",
    approval_method="multi_factor_auth"
)

# Bundle all contexts
registry = ContextRegistry(
    model_context=model_ctx,
    session_context=session_ctx,
    data_provenance=provenance,
    human_intervention=oversight
)

# Record the evidence with full context
receipt = client.record_sync(
    event_type="procurement_decision",
    payload={
        "decision": "approved",
        "vendor_id": "v_acme_corp",
        "contract_value": 500000
    },
    context=registry
)

print(f"Receipt: {receipt.event_id}")

Async Usage

For high-throughput applications, use async/await with fire-and-forget mode:

import asyncio
from solymus import Solymus

async def log_many_events():
    client = Solymus(
        endpoint="https://api.prolixotech.com",
        tenant_id="defence-supplier-123",
        api_key="ak_live_your_key",
        batch_size=100,
        flush_interval=5.0
    )

    # Fire-and-forget: returns immediately
    for i in range(1000):
        event_id = client.record(
            "access_event",
            {"user": f"user{i}", "action": "login"}
        )
        if i % 100 == 0:
            print(f"Queued {i} events")

    # Flush remaining events before shutdown
    client.flush()
    client.close()

asyncio.run(log_many_events())

Context Manager (Recommended)

Use Python's with statement to guarantee shutdown:

from solymus import Solymus

with Solymus(
    endpoint="https://api.prolixotech.com",
    tenant_id="defence-supplier-123",
    api_key="ak_live_your_key"
) as client:

    # All logs are queued and batched
    client.record("access_granted", {"user": "alice"})
    client.record("access_granted", {"user": "bob"})

    # On context exit, automatically flushes and closes

Privacy Hashing

Hash sensitive data (PII, classification markings) before sending to ProlixoTech:

from solymus import Solymus, hash_sha256

# Hash sensitive fields locally
user_email = "alice@defence-supplier.ca"
email_hash = hash_sha256(user_email)

client = Solymus(
    endpoint="https://api.prolixotech.com",
    tenant_id="defence-supplier-123",
    api_key="ak_live_your_key"
)

receipt = client.record_sync(
    "user_action",
    {
        "user_hash": email_hash,      # Only the hash is sent
        "action": "file_access",
        "resource": "PROTECTED-B-doc.pdf"
    }
)

print(f"Hashed PII sent securely: {receipt.event_id}")

SDK Support Matrix

JavaScript / TypeScript (In Dev)

A browser and Node.js SDK is currently in development. Expected release: Q2 2026.

API Authentication Contract

All API requests require authentication via the X-Api-Key header:

curl -X POST https://api.prolixotech.com/ingest \
  -H "X-Api-Key: ak_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "tenant_id": "defence-supplier-123",
    "event_type": "access_control_event",
    "payload": {"user": "alice", "action": "login"}
  }'

POST /ingest

Record a compliance evidence event.

GET /verify/{event_id}

Verify a recorded event's cryptographic signature and Merkle linkage (requires API key).

GET /public/verify/{event_id}

Public verification endpoint for auditors (no authentication required). Enables auditors to verify evidence independently:

GET /events

Retrieve all recorded events for a tenant (requires API key). Supports filtering and pagination:

GET /certificate/{day}

Generate a monthly Merkle attestation certificate signed by KMS (requires API key):

Solymus Installation Options

Deploy Solymus to your CPCSC readiness infrastructure:

Option 1: Local Installation (Recommended for Testing)

Install the Python SDK on your machine:

pip install solymus

Option 2: Docker Container

Run Solymus in a containerized environment:

docker run -e SOLYMUS_API_KEY=ak_live_your_key \
  -e SOLYMUS_TENANT_ID=defence-supplier-123 \
  prolixotech/solymus:latest

Option 3: AWS Lambda Integration

Deploy Solymus as a Lambda layer for serverless compliance logging:

aws lambda update-function-code \
  --function-name my-compliance-function \
  --layers arn:aws:lambda:us-east-1:123456789:layer:solymus:1

Browser Extension

Coming soon: A browser extension to automatically log web-based compliance actions (e.g., policy acknowledgements, access approvals).

Integrations

Beta Status: Integration features are currently in beta and undergoing testing with early customers.

M365 (Microsoft 365)

Collect evidence from Microsoft Entra ID (Azure AD), SharePoint, and Exchange logs automatically. Requires M365 admin credentials.

AWS

Ingest CloudTrail logs and VPC Flow Logs into the evidence ledger. Supports both commercial and GovCloud regions.

Custom Webhooks

Send compliance events from any third-party system via HTTP POST to a Solymus webhook endpoint.

CPCSC / ITSP.10.171

ProlixoTech serves as the evidence engine for CPCSC readiness. Mapped to ITSP.10.171 (Canada's adaptation of NIST SP 800-171 Rev 3) — 97 controls across 17 families.

How ProlixoTech Supports CPCSC

• Automated Evidence Collection: Auto-map compliance evidence to all 97 ITSP.10.171 controls
• Assessor-Ready Exports: Generate SSP, POA&M, and Evidence Index for accredited certification body assessors
• Tamper-Evident Records: KMS-signed events with Merkle verification proofs for auditor confidence
• Canadian Defence Supplier Focus: Built for CPCSC compliance requirements (Level 1 self-assessment, Level 2 third-party certification)
• Continuous Monitoring: Track CPCSC readiness in real-time with evidence coverage dashboards

ITSP.10.171 Control Families (17 total, 97 controls)

ProlixoTech can capture evidence for all 17 control families:

CPCSC Evidence Factory API

The CPCSC Evidence Factory provides a streamlined three-step flow for uploading compliance evidence (policies, access logs, assessment reports, etc.):

Step 1: Request Presigned Upload URL

curl -X POST https://api.prolixotech.com/cmmc/artifacts/upload \
  -H "X-Api-Key: ak_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "tenant_id": "defence-supplier-123",
    "filename": "AC-Policy-2026.pdf",
    "content_type": "application/pdf",
    "evidence_type": "policy_document"
  }'

Step 2: Upload to S3 (Using Presigned URL)

The API returns a presigned POST URL. Use it to upload your file directly to S3 without needing AWS credentials:

curl -X POST https://s3.amazonaws.com/prolixo-artifacts-bucket \
  -F "key=uploads/artifact-uuid" \
  -F "policy=..." \
  -F "file=@AC-Policy-2026.pdf"

Step 3: Finalize (Compute Hash & Map Controls)

Once uploaded, call finalize to compute the SHA-256 hash and auto-map the artifact to ITSP.10.171 controls:

curl -X POST https://api.prolixotech.com/cmmc/artifacts/uuid/finalize \
  -H "X-Api-Key: ak_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{}'

CPCSC Evidence Recording Example

Here's a complete example recording a CPCSC evidence event with control mapping:

from solymus import Solymus

client = Solymus(
    endpoint="https://api.prolixotech.com",
    tenant_id="defence-supplier-123",
    api_key="ak_live_your_key"
)

# Record a CPCSC access control event
receipt = client.record_sync(
    "access_control_event",
    {
        "user_id": "alice@defence-supplier.ca",
        "action": "access_granted",
        "resource": "PROTECTED-B-procurement-docs",
        "classification": "PROTECTED B",
        "timestamp": "2026-03-14T10:15:00Z"
    }
)

# Auto-mapped to ITSP.10.171 controls: AC-2, AC-3, AC-4
print(f"Event recorded: {receipt.event_id}")
print(f"Controls mapped: AC-2, AC-3, AC-4")
print(f"Signature valid: {receipt.signing_alg == 'ECDSA_SHA_256'}")

Export Compliance Packages

Generate a complete CPCSC readiness package for assessors:

curl -X POST https://api.prolixotech.com/cmmc/exports \
  -H "X-Api-Key: ak_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "tenant_id": "defence-supplier-123",
    "export_type": "evidence_index",
    "include_ssp": true,
    "include_poam": true
  }'

Plan-Based Access

Solymus offers three tiers of service, each designed for a different stage of CPCSC readiness. CPCSC Level 1 is free for a limited time. Credit card required to activate. Early bird pricing for Level 2 and Level 3 is available until December 31, 2026.

Next Steps

• Start Small: Install the SDK and record your first evidence event in 5 minutes.
• Map Your Controls: Review your ITSP.10.171 control requirements and collect evidence systematically.
• Prepare for Assessment: Export your evidence packages (SSP, POA&M) to share with your assessor.
• Continuous Monitoring: Set up automated evidence collection from your key systems (M365, AWS, custom webhooks).
• CPCSC Readiness: Use ProlixoTech to demonstrate compliance with ITSP.10.171 controls for Level 1 self-assessment and Level 2 certification.

Support & Resources

• Email: support@prolixotech.com
• Documentation: This page (frequently updated)
• GitHub: github.com/prolixotech (code examples, issue tracking)
• Status Page: status.prolixotech.com