A security layer that controls, proves and measures on every release which data goes to external AI models, for what purpose and to which provider.
"Is Our Data Going to the Model?" — "We Don't Think So" Is Not an Answer.
The moment a company starts using LLMs, customer, finance and staff data can leave inside a prompt. We narrow that path to a single egress gate. Everything bound for the model passes through it first, and in any undefined situation nothing is sent.
Personal data never reaches the model: names and record IDs become pseudonyms scoped to the conversation turn and the business, and are restored on the user's screen as the answer streams back. Unless the provider's commitments on training, retention, data region and data-protection law are on record, no call is made with real data. We don't hide the residual risk either: every release measures leakage with the same question set.
What We Build
- A fail-closed egress gate: no call without policy and purpose context
- A pseudonym vault: personal data never reaches the model
- Field manifests: what may be shared is declared field by field
- Provider contract evidence: training, retention, data region, data-protection law
- An ID-provenance gate: the model only uses identifiers it has actually seen
- Role-based leakage measurement on every release
Where It Fits
SaaS products that handle customer data, regulated sectors such as finance and health, internal AI usage policies and any AI project under data-protection law.
In Our Own Projects
Motice Shield: the protection layer behind Ask Motice, Motice's AI assistant. Its core was designed as a package independent of Motice, so the same protection can move to other products.