Public sector and healthcare
It runs air-gapped, the source is readable, and the supplier receives nothing.
This is already on your desk.
- 01
Data has to stay where you said it would stay
Residency commitments are made to citizens and patients, not to a procurement panel. Egress is allowlisted rather than merely configurable, and a per-agent policy can require a serving region, enforced on the fallback chain as well as the primary route. - 02
Safety requires a stop that somebody owns
A kill switch scoped to one agent, a team or everything, requiring an attributable actor and a reason, evaluated first so it beats every other gate. It is the stop capability the regulation asks a deployer to have. - 03
Staff are already using tools nobody procured
The shadow-AI radar reconciles five evidence sources from the security stack you already run rather than by inspecting the network. Findings tell you those agents exist; chasing them down inside your organisation is your work.
- 01
Can it run with no internet connection at all?
Yes, with two details to settle before you disconnect. A prebuilt image has no runtime dependency on a supplier service or a CDN and the console bundles its assets, so the running system reaches nothing you did not configure. Building from source still needs the pinned base image and the npm dependencies, so mirror those registries or import a verified release image first. The price catalogue ships with the product, so an offline install meters from the first request.
- 02
We cannot procure uncertified software for a critical service.
Evaluate the fit with procurement before connecting data. The default cloud pilot is free for 30 days and holds workspace evidence and encrypted credentials on Token Observe infrastructure. A separately scoped customer-hosted evaluation can keep runtime data on your infrastructure. Neither mode has a certification, independent penetration test or availability SLA; keep production-critical workloads outside the pilot. Discuss any required certification milestone and support scope in a written agreement.
- 03
What happens to our evidence if the supplier disappears or we stop paying?
That is what the terms are drafted to give you, and you have the source. The licence provides that records may be retained, exported and used indefinitely after termination, on the reasoning that losing the evidence would defeat the purpose of buying it, and it covers reading, compiling and modifying the source internally, with your modifications owned by you. Publication of what a test finds is narrower: benchmark results need no pre-approval provided the version and configuration are named, and security findings follow coordinated disclosure first.
Cloud custody and optional customer-hosted controls are described separately. The 24 limits we publish, and the 9 risks a named person has to accept in writing, are on one page.
What we do not claimRunning it where the network does not reach.
Air-gapped or on-premise is one of five documented deployment modes, and nothing about the artifact changes between them except where it runs and which egress it is permitted. So the image your team reviews in a connected environment is the image that runs in the isolated one, and the verification is short enough to do during the review: search the source for every outbound call site, then run it with egress allowed only to your own endpoints. Two facts belong in the runbook: the process speaks plain HTTP and manages no certificates, and the metrics endpoint is unauthenticated while exposing agent identifiers and month-to-date spend.
- Egress is allowlisted, not merely configurable
- Two lists constrain which hosts a provider row may name and which environment variables it may reference, and neither may be empty.
- Anchors can be written to a file
- The anchor sink can be a local file, which makes no network call at all, so an isolated deployment can still hold off-box evidence, provided the copy lands where the database administrator cannot rewrite it.
- Identity stays yours
- Sign-in is authorisation code with PKCE against your own issuer; no offline scope is requested and no refresh token is held, so nothing persisted could be replayed against your directory.
- Workspace configuration, registry, policies and decisions
- Billing evidence from the connections and imports you supply
- Supplied connection credentials, encrypted at rest
- Request metadata for traffic routed through the workspace
- Bounded, redacted prompt and reply text when capture is enabled
- Billing queries using the reporting permissions you supply
- Routed model payloads after the applicable policy checks
- Model-assisted search using a separately configured inference key
- Authorized evidence reads and CSV exports to your client
The cloud service processes and stores workspace evidence and supplied credentials. Supabase handles account authentication; Railway runs the cloud pilot. Cloud hosting does not keep all data inside your network.
Billing cannot recover historical conversations. Activity covers routed traffic or supported evidence supplied to the workspace. Text capture is off by default, and redaction is heuristic.
Customer hosting is an optional, separate deployment choice. Its infrastructure and data boundary differ from the cloud pilot.
The radar reconciles evidence you already hold. It does not inspect your network.
Five evidence sources: vendor bill reconciliation, network egress analysis, service-account key audit, developer tool telemetry, and the gateway's own caller and price consistency checks, including an hourly roll-up of credentials presented at the door and rejected, so an unrecognised credential in circulation becomes a finding rather than a log line nobody searches for.
The integration direction is the security argument. Token Observe holds no standing broad credential into your stack: your gateway, proxy or SIEM pushes evidence to it, which is both the shorter review and the smaller blast radius. Two scheduled pull connectors are the named exception (GitHub Copilot and Cisco Umbrella), each on a read-scoped credential you supply, both off until you set it.
This is what does the work.
Agent registry
One record per agent, and it is the record the gateway enforces against.
Policy engine
One deterministic verdict on every governed request: allow, block, redact, or park it for a human.
Flight recorder
Every governed request in a timeline a compliance officer can read, and a search box that never writes SQL.
Questions
Does patient or citizen data ever leave our network?
Only to endpoints somebody in your organisation configured, and only after policy evaluation and redaction: your model providers, tool servers, webhook receivers, identity provider and anchor sink, plus a public price catalogue an administrator triggers by hand, and the two vendor pull connectors if you enable them. There is no default egress, and the supplier receives nothing.
How does this help with an AI system inventory?
The registry is the inventory, and it is the same record the gateway enforces against on every request rather than a report generated from it, which is the only structural reason it cannot drift from reality. Four fields are required to create an agent: name, owner email, team and declared purpose. Risk tier, budgets and data policy sit alongside them, and metadata is where an impact-assessment reference lives.
Who signs off the residual risks in a public body?
Whoever your governance requires, and the product tells you which risks need signing rather than leaving you to find them. The threat model names, per risk, the role that must record a dated acceptance: the CISO for six, the Data Protection Officer for regex-based detection, the Head of Product for unverified provider flags, the engineering lead for single-writer storage. Nine risks, four roles, none accepted until a named person dates it.
Bring the objection that is not on this page.
Create a cloud account and workspace. No card or server installation. Model calls and Google BigQuery scans can incur separate provider charges.