One kernel.
Three products.
Every answer, provable.
ClaimZen is not an AI that reads your healthcare mail. It’s a deterministic, cryptographically signed truth plane: every message, claim, chart, and legacy record becomes an immutable, replayable, verifiable event. AI proposes; only deterministic code decides; every conclusion ships a proof that verifies offline — without us.
The architecture film · ~8 min · for engineers
Separate the transport from the truth.
Email, EDI, payer portals, and a decades-old PMS are all untrusted transport. The kernel is the governed intelligence around them: it converts every inbound or outbound communication into a canonical, policy-governed, reproducible case — and past that boundary, nothing is trusted until it is proven.
Untrusted transport
SMTP, JMAP, EDI, SFTP, portal, fax, webhook — behind one adapter that is the only thing touching the network. It freezes the exact wire bytes into a content-addressed blob.
Deterministic kernel
A pure, event-sourced core folds observations into a case state you can replay byte-for-byte and cryptographically verify. Same inputs, same conclusions — always.
AI, contained
The model is an untrusted coprocessor. It reads ambiguity and proposes; a deterministic gate corroborates every value against the source; a human authorizes. It never manufactures truth or executes an action.
One deterministic, signed core.
Every product on ClaimZen is the same kernel pointed at a different domain. It is small, decomposable, and unforgiving about where truth comes from.
Event-sourced state
An append-only log of typed events; a pure reduce folds them into case state. The state root is a BLAKE3 hash over canonical JSON — a single fingerprint of everything derived.
Hash-chained, signed ledger
Every entry digest covers the previous one, Ed25519-signed by a key sealed at rest (XChaCha20 · Argon2id). History can’t be edited, reordered, or truncated without breaking the chain.
Fact · Claim · Evidence · Decision
Observations become Facts, content-addressed to their source. Verbs propose Claims. Claims verify into Evidence. And only deterministic code promotes a verdict to a Decision — never the model.
Pure policy engine
A content-addressed, versioned .aion policy bundle — no clock, no network, no randomness — evaluates the folded case and emits obligations. What fired is always auditable.
Two-phase actions
Nothing acts on the outside world in one step. A plan is proposed and its digest sealed; a human authorizes; only then does a capability execute — through a digest gate that refuses anything but the exact approved bytes.
Evidence packets & tenancy
Any case exports as a signed packet — the ledger slice and its blobs — that verifies offline, without the server. The whole kernel is one tenant silo; run N, each with its own key, ledger, and evidence.
The same core, three domains.
Each product reuses the runtime, ledger, policy engine, AI containment, and action protocol unchanged — and each deepens the same verified-truth dataset.
Prove payers wrong — and remember it.
Inbound payer correspondence is correlated to a case and checked by eight verification verbs against ground truth: the payer’s own 271/277 responses, the provider’s records (filing dates, authorizations, contracted amounts), and the CARC standard itself. A contradiction is sealed as a fact; policy holds the case; a human approves an evidence-backed appeal.
The record and the evidence are the same object.
The whole running state of a practice — charts, schedules, ledgers — is the same signed event stream. Three clinical coprocessors read the world and propose; each is gated exactly like the denial extractor (evidence must appear verbatim, the code must be on the fee schedule, the pixels never touch the ledger); a clinician signs. A confirmed finding drives a treatment plan; the same chart facts assemble a claim; a denial re-enters Recovery.
Leaving the old system becomes a proof.
The incumbent’s only real moat is switching cost. Migrate removes it: an AI coprocessor reads a legacy PMS (Eaglesoft, Dentrix, Open Dental), proposes the crosswalk from its foreign schema to the canonical one, and dry-runs the migration until every total ties the legacy system’s own trial balance — to the cent. Only a green reconciliation can be signed, into an attestation that verifies offline. Then it cuts over onto the truth plane.
Deterministic. Replayable. Signed.
External systems — payers, portals, clearinghouses, models, clocks, humans — produce recorded observations. They never participate invisibly in the reducer.
- ✓ Same events + policy bundle + versions ⇒ the same state root, findings, decisions, and explanation graph.
- ✓ Every claim and every migration ships a signed evidence packet that verifies months later, offline, without trusting us.
- ✓ A HIPAA-grade audit trail and medico-legal chart integrity fall out for free — they were already events.
Stalwart is the mail plane. ClaimZen is the truth plane. AI can interpret ambiguity — but it cannot silently manufacture truth or execute an unapproved action.
The one architectural decisionIt holds under load.
A synthetic DSO corpus at Heartland size, folded and checked against an independent oracle recomputed from the raw rows.
See the full spectrum, running.
The kernel, the three products, and the proofs — live. We’ll walk you through denial recovery, the Practice desk, and a legacy migration reconciled to the cent.
Get early access