One security fabric for the whole AI factory

Four intake bands

Each band guards one way into a running AI system, with its own gates, in order, and the same record at the end.

• Model supply chain

  Nothing serves that was not scanned, described and signed. A model arrives from Hugging Face, NGC, an open-source repo, your own team or an air-gapped mirror, and it has to earn its way to an endpoint.

• Data ingestion and encrypted retrieval

  Retrieval is an attack surface, and an embedding is not anonymous: source content can be rebuilt from it. Only clean, de-identified, signed content reaches the store, and it arrives already encrypted under keys you hold.

• Prompts, APIs and agents

  Every prompt is a policy decision before it is a model call, and every agent action is checked against what that agent is allowed to do. User input, API traffic and autonomous actions pass the same checks, and the answer can be no.

• Observability and audit

  Every gate in the other three bands writes here. One normalized stream, one immutable audit record and one set of cases in your SOC, so a control you claim is a control you can show.

A fifth band for agents and MCP gateways is in development; agent controls run in the prompts, APIs and agents band today.

One policy plane

The bands don't each bring their own rules. They share five services, so one decision means the same thing everywhere.

• Policy and governance

  Every gate in every band is an Open Policy Agent decision. Policy lives as code, versioned and reviewed like any other change, and one rule can apply across all four bands.

• Identity and access

  Users, tenants, services and agents each carry an identity. Agents get SPIFFE workload identities, so a running workload is verified, not assumed.

• Audit and compliance

  Every decision lands in one append-only record, mapped to the frameworks you answer to and forwarded to your SIEM.

• Encryption and signing

  Models and datasets are signed with Sigstore. Content is encrypted under keys you hold, with post-quantum algorithms alongside the classical ones.

• Integrated workflows

  Findings open tickets, incidents land in your SOC queue and remediation runs through your ITSM. The platform hands work to the tools your teams already use.

Every workload inherits the controls

Whatever you deploy to, it is gated the same way and writes back to the same telemetry stream.

• Model serving

  Endpoints come up with their runtime guardrails attached, on KServe, NVIDIA NIM or Triton.

• Applications

  Chat, search and copilots built on your models inherit the same prompt and output checks.

• APIs and services

  Service-to-service calls pass the same authorization, rate limits and filters as people do.

• Agentic systems

  Agents run with an identity, a sandbox and a policy on every tool, model and data source they touch.

• Edge and on-prem

  The same gates run on your own hardware, in your jurisdiction, including air-gapped sites.

Where it runs

On the infrastructure you already run, under keys you already hold.

• Any Kubernetes platform

  SUSE Rancher, Red Hat OpenShift, Rafay or NVIDIA's AI platforms. The fabric sits above the platform, so you can change it without changing your controls.

• Your hardware and keys

  GPU node pools, in-jurisdiction KMS or HSM, and isolated landing, quarantine and clean storage tiers for what comes in.

• Sovereign by default

  Nothing leaves your environment for a vendor cloud. The platform holds no key material, so a breach of the platform is not a breach of your content.