Traceability, Audit, and Transparency

Trust in a data space depends on being able to demonstrate, whenever there's doubt, what happened, when, and under what conditions. Beyond the identity and credentials of each participant (digital certificate, PSD, DID), Cortex keeps a record of activity around data, actions, and agreements, and makes it available to every participant.

What Gets Recorded?

• Connection sessions: every time a participant uses the data space connector (to publish or consume), an identifiable session is opened and closed, linked to their verified identity.

• Publication history: every publication or unpublication of a dataset is recorded, along with the date and the outcome of the operation.

• History of operations on the data: risk analysis, profiling, cleaning, and metadata changes applied to each dataset are recorded as part of its governance.

• Dataset self-description (DSD): digitally signed and available for consultation, it serves as verifiable evidence of what was agreed to be published.

What a Participant Can Check

From the platform's observability section, every participant can:

• Check the status of their published datasets (validated, private/public, anonymized, acquired, etc.).

• View the history of actions performed on their own data.

• Check the risk and regulatory compliance level calculated for each of their datasets.

Everything related to certificates, credentials, and participant identity (issuance, renewal, revocation, access via "My Resources") is described in the Governance and Regulatory Compliance section.

Audit

Cortex maintains a centralized record of transactions and contracts (in the style of a "Clearing House"): a ledger that links each agreement between provider and consumer to a unique digital fingerprint, useful as evidence in the event of a dispute or audit, without needing to store the data itself and while preserving participant privacy.

This capability is under continuous expansion as the data space evolves.