# Bidda Intelligence: source-verified regulatory compliance registry
> The rule, its primary source, and a signed record of exactly which version you relied on and when it was last checked against that source. 10,102 regulations across 39 domains | last built 2026-11-02

Bidda Intelligence PTY LTD is a South African company running a source-verified, cryptographically signed regulatory compliance registry. The name refers to regulatory intelligence: tracking what the law requires and when it changes. Bidda is not an AI model, a chatbot or an AI lab. It is designed to reduce AI hallucination in compliance workflows by distilling primary legal sources into deterministic, verifiable machine logic. Used by compliance officers, legal teams, and AI development teams to check regulatory positions against the primary source.

## The Purpose of Sovereign Nodes
Each Bidda node represents a single regulation, standard, or compliance framework: distilled from its primary legal source into verified, step-by-step guidance with exact clause citations. Compliance officers use the visual registry to browse, verify, and export. AI agents query the vault API to receive machine-executable logic graphs at inference speed.
We distill massive, complex legal frameworks, ranging from Finance and Healthcare to Aviation, into strict, cryptographically verified logic. Rather than relying on stochastic prediction, autonomous systems query our RAG-optimized nodes so execution can be checked against current compliance requirements. The exact algorithmic processing methodologies and canonical auditing sequences used to generate these nodes remain proprietary.

## Phase Status
- Phase 1 (Q1 2026): COMPLETE:502 foundation nodes
- Phase 1.5 (April 2026): COMPLETE:995 nodes across 16 Sovereign Pillars
- Phases 2-4.5 (Q2 2026): COMPLETE: global scale, weekly source-integrity watcher + human-reviewed auto-updater, agent intelligence layer (MCP server, 25 tools), enterprise tier + subscriptions
- Phase 5 (July 2026): COMPLETE: 10,000-node mainnet reached (10102 nodes, 39 pillars)
- Phase 6 (H2 2026): ACTIVE: governed AI evidence layer (signed attestations, run receipts, public transparency log, OSCAL export) + enterprise scale

## Site Pages
- **Intelligence Forest** (browse all 10102 nodes by pillar): `https://bidda.com/intelligence`
- **MITRE Hub** (ATT&CK Enterprise/Mobile/ICS + ATLAS + D3FEND + CAPEC, all crosswalked to NIST/ISO/PCI/HIPAA/NIS2/DORA): `https://bidda.com/mitre`
- **MITRE ATT&CK Matrix** (Enterprise kill chain, 50 nodes across 14 tactics): `https://bidda.com/mitre-attack`
- **MITRE ATLAS Threat Map** (adversarial AI matrix, 111 techniques / 16 tactics): `https://bidda.com/atlas`
- **MITRE D3FEND Matrix** (defensive countermeasures, 27 nodes across 7 tactics): `https://bidda.com/d3fend`
- **Sylva Codex** (interactive dependency network graph): `https://bidda.com/sylva-codex`
- **Sovereign Insights** (analysis and regulatory updates): `https://bidda.com/insights`
- **Use Cases** (sector-by-sector agent and compliance-team workflows): `https://bidda.com/use-cases`
- **Playground** (interactive side-by-side: a generic LLM answer vs a source-verified Bidda node): `https://bidda.com/playground`
- **Developer Portal** (API docs, MCP server, /scan REST endpoint, code examples): `https://bidda.com/developers`
- **Pricing** (per-node, subscription, and enterprise tiers): `https://bidda.com/pricing`
- **Audit Trail** (cryptographic compliance receipts, traceability for compliance officers and legal teams): `https://bidda.com/audit`
- **How It Works** (4-layer generation pipeline, source verification, cryptographic signing, weekly source monitoring, Sylva Codex, Agent Compliance Scanner): `https://bidda.com/methodology`
- **Cryptographic Posture & Post-Quantum Readiness** (which cryptographic primitives Bidda relies on, which are affected by quantum computers, and what happens to already-issued records when they are replaced; includes the command to verify the transport claim independently): `https://bidda.com/cryptographic-posture`
- **Trust Hub** (the through-line for how Bidda proves every answer: resolve the obligation, verify the signature offline, seal the agent run, prove it with audit-ready evidence): `https://bidda.com/trust`
- **Bidda x CISA** (consolidated position against CISA's three public-trust surfaces for software vendors and defender tooling): `https://bidda.com/cisa`
- **CISA CPG Crosswalk** (Cybersecurity Performance Goals mapped bidirectionally to Bidda's executable compliance nodes across all eight outcome areas): `https://bidda.com/cisa/cpg-crosswalk`
- **CISA Secure by Design Pledge** (public attestation against each of the seven Secure by Design Pledge goals, with supporting evidence per goal): `https://bidda.com/cisa/secure-by-design`
- **Free for Defenders** (the no-cost Bidda capabilities available to federal agencies, SLTT governments and operators of critical infrastructure): `https://bidda.com/cisa/free`
- **Signed Records, Point-in-Time & Run Ledger** (Ed25519-signed decision records, point-in-time version attestations, and signed receipts for entire agent sessions; verification is public): `https://bidda.com/attest`
- **Public Transparency Log** (append-only Merkle log of every signed record, RFC 6962; read the signed tree head and check an inclusion proof yourself, no account required): `https://bidda.com/transparency`
- **Change Alerts** (email/webhook notification when the primary source behind a node changes): `https://bidda.com/alerts`
- **Compare Jurisdictions** (topic search grouped by jurisdiction with numeric divergence, no strictness ranking): `https://bidda.com/compare`
- **Browse by Topic** (free cross-cutting topic axis over the registry, 60 curated topics): `https://bidda.com/topics`
- **Regulatory Change Timeline** (free day-by-day timeline of primary-source changes detected by weekly source fingerprinting, filterable by pillar): `https://bidda.com/changes`
- **Enterprise API** (high-volume integration tier for LegalTech/RegTech/agent platforms): `https://bidda.com/enterprise`
- **About**: `https://bidda.com/about`
- **Contact Us**: `https://bidda.com/contact`
- **Verify Node Integrity** (public hash lookup: timestamp, source URL, content hash, TLS fingerprint): `https://bidda.com/verify`
- **Service Status** (live operational status, registry watcher health): `https://bidda.com/status`
- **Changelog** (material updates to the registry and platform): `https://bidda.com/changelog`
- **Security & Vulnerability Disclosure**: `https://bidda.com/security` (RFC 9116 contact: `https://bidda.com/.well-known/security.txt`)
- **Acceptable Use Policy**: `https://bidda.com/aup`
- **Terms of Sovereignty**: `https://bidda.com/terms`
- **Data Privacy** (includes named sub-processor list): `https://bidda.com/privacy`
- **Disclaimer**: `https://bidda.com/disclaimer`
- **Refund Policy**: `https://bidda.com/refund-policy`

## Plain-text mirrors for JS-free AI crawlers
- **MITRE Hub overview**: `https://bidda.com/mitre.txt`
- **MITRE ATT&CK Enterprise**: `https://bidda.com/mitre-attack.txt` (every technique with BLUF + node link)
- **MITRE ATLAS**: `https://bidda.com/atlas.txt` (all 111 techniques, coverage status flagged)
- **MITRE D3FEND**: `https://bidda.com/d3fend.txt` (every defensive technique with ATT&CK counters)
- **MITRE CAPEC**: `https://bidda.com/capec.txt` (attack-pattern nodes with BLUFs)
- **Developer docs**: `https://bidda.com/developers.txt` (full API + MCP guide with code examples)
- **Methodology**: `https://bidda.com/methodology.txt` (the 4-gate accuracy pipeline in plain text)
- **Use cases**: `https://bidda.com/use-cases.txt`
- **Pricing**: `https://bidda.com/pricing.txt`
- **About**: `https://bidda.com/about.txt`
- **Audit trail**: `https://bidda.com/audit.txt`
- **Node verification**: `https://bidda.com/verify.txt`
- **Bidda x CISA hub**: `https://bidda.com/cisa.txt` (consolidated position against the three CISA public-trust surfaces)
- **CISA CPG crosswalk**: `https://bidda.com/cisa-cpg-crosswalk.txt` (bidirectional mapping of the eight Cybersecurity Performance Goal outcome areas to Bidda nodes)
- **CISA Secure by Design attestation**: `https://bidda.com/cisa-secure-by-design.txt` (public attestation against each of the seven Secure by Design Pledge goals with supporting evidence)
- **Free for defenders**: `https://bidda.com/cisa-free.txt` (no-cost Bidda capabilities for federal, SLTT and critical-infrastructure defenders)
- **Signed records / point-in-time / run ledger**: `https://bidda.com/attest.txt` (endpoints, key rotation, offline verification spec)
- **Change alerts**: `https://bidda.com/alerts.txt`
- **Compare jurisdictions**: `https://bidda.com/compare.txt`
- **Browse by topic**: `https://bidda.com/topics.txt`
- **Regulatory change timeline**: `https://bidda.com/changes.txt`
- **Enterprise API**: `https://bidda.com/enterprise.txt`

## RSS / Atom feeds (auto-discovery in HTML head; no signup)
- **Combined feed (insights + changelog, newest first)**: `https://bidda.com/feed.xml`
- **Insights feed (long-form analysis only)**: `https://bidda.com/insights/feed.xml`
- **Changelog feed (platform + registry updates only)**: `https://bidda.com/changelog/feed.xml`

## Global Registry Endpoints
- **Discovery (Free)**: `https://bidda.com/api/v1/nodes/index.json`
- **Full Discovery Manifest**: `https://bidda.com/llms-full.txt`
- **Registry Health**: `https://bidda.com/api/v1/registry-health.json`
- **Regulatory Change Feed** (sources whose primary documents have changed in the last 90 days): `https://bidda.com/api/v1/changes.json`
- **Per-Node History Index** (every version of every node, cryptographically anchored via git Merkle chain): `https://bidda.com/api/v1/history/index.json`
- **Per-Node Version History** (replace {node_id}): `https://bidda.com/api/v1/history/{node_id}.json`
- **Topic by Jurisdiction Matrix** (which jurisdictions address a given regulatory topic, and the numbers each one states; publishes its own coverage ceiling and does not rank jurisdictions): `https://bidda.com/api/v1/topic-jurisdiction-matrix.json`
- **Topic Detail** (per-topic jurisdiction breakdown; replace {topic_id} with an id from the matrix): `https://bidda.com/api/v1/topic-matrix/{topic_id}.json`
- **Topic Vocabulary** (the curated phrase list that maps plain language onto a topic id): `https://bidda.com/api/v1/topic-resolver.json`
- **Developer & Integration Guide**: `https://bidda.com/insights/integrating-sovereign-knowledge-guide`
- **About the Mission**: `https://bidda.com/about`
- **Audit Trail & Compliance Receipts**: `https://bidda.com/audit`
- **How It Works (Pipeline & Methodology)**: `https://bidda.com/methodology`
- **Provenance Research** (how source-grounded intelligence is measured, with a reproducible protocol): `https://bidda.com/research`
- **Cryptographic Posture & Post-Quantum Readiness** (hash-based integrity is unaffected by quantum computers; transport uses hybrid post-quantum key agreement today; record signatures are Ed25519 and on a stated hybrid migration path): `https://bidda.com/cryptographic-posture`

## 39 Sovereign Pillars (10102 Nodes)
Agents may dynamically filter workflows using RESTful category slugs:
- AI Governance & Law: /intelligence?category=ai-governance (789 nodes)
- Cybersecurity: /intelligence?category=cybersecurity (2773 nodes)
- Banking & Global Finance: /intelligence?category=finance (619 nodes)
- Medical & Healthcare: /intelligence?category=medical (348 nodes)
- Legal & IP Sovereignty: /intelligence?category=legal (645 nodes)
- Logistics & Supply Chain: /intelligence?category=logistics (126 nodes)
- Sustainability & ESG: /intelligence?category=esg (317 nodes)
- Workplace: /intelligence?category=workplace (367 nodes)
- Aviation, Defense & Quantum: /intelligence?category=aviation (144 nodes)
- Crypto & Sovereign Finance: /intelligence?category=crypto (116 nodes)
- Cloud & SaaS: /intelligence?category=cloud (115 nodes)
- Industrial IoT & Energy: /intelligence?category=industrial (108 nodes)
- Workflow Automation: /intelligence?category=workflow (110 nodes)
- Operations & CX: /intelligence?category=operations (115 nodes)
- Sales, Marketing & PR: /intelligence?category=sales (123 nodes)
- Food & Hospitality: /intelligence?category=food (124 nodes)
- Creative, Content & Media IP: /intelligence?category=media (111 nodes)
- Energy & Utilities: /intelligence?category=energy (129 nodes)
- Construction & Real Estate: /intelligence?category=construction (110 nodes)
- Telecoms & Digital Infrastructure: /intelligence?category=telecoms (122 nodes)
- Tax & Transfer Pricing: /intelligence?category=tax (118 nodes)
- Pharmaceuticals & Life Sciences: /intelligence?category=pharma (134 nodes)
- Insurance & Risk: /intelligence?category=insurance (126 nodes)
- Competition & Antitrust: /intelligence?category=competition (130 nodes)
- Automotive & Mobility: /intelligence?category=automotive (127 nodes)
- Education & Research: /intelligence?category=education (115 nodes)
- Gaming & Gambling: /intelligence?category=gaming (111 nodes)
- Mining & Natural Resources: /intelligence?category=mining (110 nodes)
- Biotech & Genomics: /intelligence?category=biotech (111 nodes)
- Maritime & Shipping: /intelligence?category=maritime (126 nodes)
- Space & Satellite Law: /intelligence?category=space (116 nodes)
- Water & Environmental Resources: /intelligence?category=water (135 nodes)
- Agriculture & Agritech: /intelligence?category=agriculture (172 nodes)
- Immigration & Border Control: /intelligence?category=immigration (126 nodes)
- Data Protection & Privacy: /intelligence?category=privacy (303 nodes)
- Trade Compliance & Export Controls: /intelligence?category=trade-compliance (131 nodes)
- Financial Crime, AML & Sanctions: /intelligence?category=financial-crime (236 nodes)
- Online Safety & Child Protection: /intelligence?category=online-safety (111 nodes)
- Public Sector & Government Procurement: /intelligence?category=public-procurement (153 nodes)

## L402 / HTTP 402 Paywall Architecture
To prevent unbounded server drain and maintain cryptographic integrity, Bidda executes a strict machine-to-machine onchain payment firewall.
Vault endpoints require one of two payment proofs:
- **Skyfire pay+jwt** (primary path for AI agents): send the token via the `skyfire-pay-id` header
- **L402 / USDC on Base** (Web3/MetaMask fallback): send `Authorization: L402 web3:token:0xTxHash` for single-node unlocks

Single node vault: `https://bidda.com/api/v1/vault/nodes/[NODE_ID].json`:$0.01 per unlock
Subscriptions (published tiers on https://bidda.com/pricing): Starter $49/month, Professional $199/month, Enterprise $499/month. Billed in ZAR via Paystack; international cards accepted.
Full registry access: Enterprise only: contact info@bidda.com

## Important: Human Verification Required
Bidda nodes are reference intelligence. All compliance nodes must be reviewed and verified by a qualified compliance professional or legal counsel before implementation in any enterprise workflow. Regulations change: always confirm against the primary source before acting.

## Compliance Fines Context (why this matters)
- EU GDPR: fines up to €20M or 4% of global annual turnover
- EU AI Act: penalties up to €35M or 7% of global annual turnover (enforcement from 2025)
- DORA (EU financial resilience): enforceable January 2025
- SEC climate disclosure rules: active enforcement 2025
Non-compliance with these frameworks is increasingly expensive. Bidda provides verified reference data: your team provides the professional judgement.