FOR WORK YOU WILL NEED TO STAND BEHIND
A record you can prove, in your own cloud.
Turn on Provenance and your workspace keeps a record of what happened: who did it, what changed, why, and who signed. It lives in your own Azure storage, chained so you can check it yourself.
New to OpenX? Key terms →
WHAT A RECORD CARRIES
- Actor
- Resolved by the server, never taken from the caller
- Chain
- Hash-linked to the record before it
- Correction
- A new record with a reason, never an overwrite
- Signature
- Bound to a digest of that exact record
- Storage
- Create-only, in your subscription
Your record, in your storage, with its proof.
FROM FIRST SAVE TO FINAL SIGNATURE
Corrections, not overwrites.
Written once, in your storage
Records go to create-only storage in your subscription, each linked to the last in a hash chain.
Prove it is intact
Query, export and verify the chain yourself. CSV exports are made safe against spreadsheet formula injection.
Who did it, for real
The server resolves the actor on every record. An identity supplied by the caller is ignored.
Corrections with a reason
An amendment records the change and a reason from a set list, and can need a second person to approve it.
Signatures that stay put
Sign against a digest the server computes, group signers into one ceremony, and choose when signers sign in again: never, once a session, or every time.
Sent where it is needed
A ProvenanceLog node forwards the records you choose to an IoT Hub connection, for the systems downstream.
IF SOMEONE WILL ASK WHO CHANGED IT
For teams that have to show their work.
Quality and compliance leads
Show who changed what, why, and who signed. Provenance is built with 21 CFR Part 11 and EU Annex 11 in mind, with a compliance matrix in the docs. Validation stays yours.
IT
Keep the record in the company's own storage and region, not a vendor's.
Teams adopting AI
Agents connected over MCP propose changes for a person to accept, and cannot edit the record.
NEXT TO YOUR QUALITY SYSTEMS
Not a QMS. The record under everything you build.
Quality suites, signing tools and lab systems all keep audit trails, and they do it well. Provenance gives the data, apps and AI around them a record of their own, written by the capabilities in your workspace.
- One record your workspace's capabilities write to, kept in your own Azure.
- Corrections, signatures and forwarding are built in, not a separate product.
- An AI connected over MCP proposes changes for a person to accept, and cannot edit the record.
WHEN THE RECORD MATTERS
From a reading to a signed correction.
A deviation, end to end
- 01A warm query finds a sensor excursion.
- 02A QA app you build on OpenX records a correction with a reason.
- 03A reviewer signs it, signing in again to do so.
Feed the systems downstream
- 01The ProvenanceLog node picks the records to forward.
- 02Amendments flow to an IoT Hub connection.
- 03A QMS integration picks them up from there.
Prove it later
- 01An auditor asks for the record.
- 02You export it from your own storage.
- 03You run verify on the same range, and keep its answer with the export.
WHERE A RECORD GETS ASKED FOR
A history that holds up.
LIFE SCIENCES
Data integrity for monitoring and lab data, with the docs' ALCOA++ mapping to start your own validation from.
MANUFACTURING
A traceable change history for quality data.
ENERGY AND BUILDINGS
An auditable record of meter and billing corrections.
Keep the record. Keep the proof.
Provenance runs in your own Azure, alongside everything else in your workspace.
GO DEEPER
MORE OF OPENX
AI governance →
Over MCP, AI proposes and a person accepts. Only a person deploys.
OpenX MCP Server →
A few tools let any MCP-capable AI read your workspace and propose changes to it.
API Manager →
Your workspace is already an API. Decide who may call it and what each caller reaches.
Warm queries →
Save a question over live data and serve the answer to dashboards, apps and AI.
Your cloud →
Connect your Azure, build the landing zone, and the rest of OpenX runs inside it.
Databases →
A Cosmos DB store in your subscription, with a governed API for each container.
App Identity →
Your own sign-in directory, identities for your jobs, and access in one window.
Licenses →
Sell what you build on your own Stripe, and turn a subscription into a plan's rights.
IoT →
IoT Hub and Data Explorer in your Azure, feeding queries, APIs and AI.
Communications →
Send mail through your own relay, with the password in your vault and sends on record.
App building →
Data, sign-in, access, an API and billing: your app's backend, already there.