AI Governance That Keeps You Compliant

Read-only by construction

The agent connects to your cloud accounts, repositories, identity provider and document stores to read posture — and only to read it. The connector interface has no write method at all, so there is nothing for a misconfiguration to expose.

Findings travel, evidence doesn’t

For each control the agent sends a signed finding: pass or fail, how it was determined, a confidence score, a timestamp, and a SHA-256 reference to the evidence. The evidence artifact itself stays on your infrastructure. The wire format rejects any field outside that list.

Posture facts, not documents

To answer “is there an approved retention policy, and when was it last reviewed?” the agent reads whether the document exists and its review date — never the body. Identifiers such as file paths, URLs and resource IDs are hashed before they leave your network.

Your models, or none at all

Where a judgement call is needed, the agent can run entirely against your own Ollama, vLLM, llama.cpp or LM Studio instance. A fail-closed policy engine refuses to send anything you have classified as confidential or restricted to a hosted model — and treats a backend it cannot identify as hosted rather than assuming the safe case.

Bundesgefördert

Ausgezeichnet mit dem EXIST-Gründungsstipendium des Bundesministeriums für Wirtschaft und Energie, kofinanziert aus dem Europäischen Sozialfonds Plus.

Ausgründung der Universität

Inkubiert an der Universität Koblenz, wo unsere Forschung zur angewandten KI-Governance begann.

Recht und Technik, gemeinsam

Gegründet von Juristinnen und Systemingenieuren — den beiden Disziplinen, die dieses Problem wirklich braucht.