Open source. Self-hosted. European.
AI governance belongs in your tenant.
So we gave the toolkit away. Run the SDK, the gateway and the agent controls inside your own cloud account — see what every model call costs, block what should never be sent, and keep every agent accounted for, without routing your prompts through anyone else first.
In the toolkit
- Runs where you do
- Your own Azure, AWS or GCP account, or your own hardware. Containers and compose files, not a sales call.
- Nothing has to leave
- Self-host in an EU region and prompts, logs and keys stay inside it. Sovereignty by deployment, not by promise.
- Yours to audit
- Apache 2.0 and MIT. Read the code, fork it, and keep running it if we stop being useful.
Built in Norway and the UK. Run it yourself, or let us host it in the EU.
- 40+ years shipping secure software
- 100+ CIOs & CISOs interviewed
- Backed by Innovation Norway & Microsoft for Startups
- Trusted by a leading Nordic insurer
Where it runs
Your cloud account. Your region. Your keys.
Everything in the toolkit ships as containers with a compose file. Deploy it into the subscription you already have, and the prompts, the logs and the provider keys stay inside your own boundary.
That is what turns sovereignty from a contract clause into a deployment detail. If the data never leaves your tenant, there is no transfer left to argue about with your regulator.
Your own cloud account
Azure, AWS or GCP, in the subscription and region you already run. Atlas AI, the SDK and the agent shield each ship a compose file.
Your own hardware
On-premises or air-gapped, when a cloud account is not the answer. The same containers, no phone-home.
An EU region, hosted by us
If you would rather not operate it, we run it for you in Europe — the managed option, not the only option.
A laptop, first
docker compose up, and the collector is running locally. Try it on real traffic before anyone deploys anything.
Built in Norway and the UK. Controls are mapped to the EU AI Act, DORA, NIS2, GDPR, the NIST AI RMF and ISO 42001, so the evidence comes out in the shape an auditor already expects.
The gateway
Every model call through one route, and the route is yours
Point your code at a gateway running in your own account and every request from every team passes somewhere you control. That is the point at which you can see what is being spent, enforce what is allowed, and send each task to a model that is good enough for it.
Model vendors are paid by the token, so nobody selling you one has a reason to send your work somewhere cheaper. Putting a gateway in front of them makes that your decision instead.
Connects to what you already run
Your SIEM, GRC and ITSM tools plug in as connectors, and anything else goes through the SDK. Nothing has to be replaced for the gateway to see the traffic.
Usage and cost in one place
Spend by vendor, by model and by team, measured against what was estimated, so an unexpected invoice becomes a line you can point at rather than a surprise.
The cheap wins, found and priced
Most traffic is classification and extraction that a smaller model handles for a fraction of the price. Atlas finds that work, prices the swap, and shows what the change is worth — the decision, and the switch, stay yours.
Policy enforced where AI is used
Start in guideline mode and watch what would have been blocked. Promote a rule to strict once you trust the false-positive rate, not before.
Sensitive data stopped before it leaves
Prompts are inspected on the way out. Personal data is redacted and injection attempts are blocked, with every hit counted so you can see which rule is actually doing the work.
Evidence that any of it worked
Usage on its own proves nothing. Atlas weights it by whether the output survived, so the number you take to the board is what landed, not what was generated.
Screens are from Atlas AI, shown with the seeded demo dataset used in our walkthroughs.
Agents
An agent holds your credentials and reads untrusted text all day
That is the whole attack. Text the agent reads becomes instructions the agent follows, and it is already authenticated as someone. Endpoint detection sees a legitimate process; the proxy sees an allowed egress; DLP sees an authorised read.
The tool call is the one place the intent is visible. So that is where the check belongs — and it runs in your tenant, next to the agent, not in somebody else's cloud.
Find them across AWS, Azure and GCP
A meta-agent queries Bedrock AgentCore, Azure AI Foundry and the GCP Knowledge Catalog, then sorts what came back into registered, pending, shadow and residency risk — so an agent running in the wrong region is a flag, not a surprise.
Pause or quarantine any one of them
Beta in Atlas AIThe whole fleet with its cloud, control state, health, risk score, 30-day cost and lifecycle stage, and the pause, quarantine and release actions next to each row.
Stop the injection at the tool call
OpenClaw Prompt Shield is a policy layer between a computer-use agent and the tools it invokes. Every shell command, file operation and network request is checked before it runs, with Azure Prompt Shield handling jailbreak and indirect-injection detection inside your own Azure tenant. Start in monitoring mode, and switch to enforcing once you have read what it would have blocked.
openclaw-promptshield · MITWatch the agents on the laptop
Agent Sentinel is the on-device half: an agent on a Mac holds credentials, reads files and calls the internet, and Sentinel shows what it did, governs what it can reach, and gives you a kill switch that works without a network round trip.
Early accessScreens are from Atlas AI, shown with the seeded demo dataset used in our walkthroughs.
The repositories
Released so far, and free to run today
Components go out one at a time, each with a post explaining it. Everything listed here is public and licensed right now — nothing on this list is a promise.
We are plain about the commercial side, because a security company saying “it is all free” invites a fair question about what it sells. The code was never the hard part. What is hard to rebuild is the policy library that comes from running this in regulated places, the evidence an auditor accepts, and someone to call at 3am. If you can run it yourself, run it yourself — we would rather that than have you pay for something you do not need.
- Apache 2.0
Atlas AI
AI governance platform: inventory, risk and policy
- Apache 2.0
AI-SPM dashboard
Map AI use cases to risks, owners and frameworks
- Apache 2.0
Promptly for the browser
Step-by-step guidance inside web apps
- Apache 2.0
Chrome and Edge extension
Catches personal data before it reaches an AI tool
- Apache 2.0
Windows assistant
In-context suggestions across Windows apps
- Apache 2.0
Developer SDK and gateway
See every LLM call your code makes, with owner and cost. Ships the gateway under gateway/
- MIT
OpenClaw Prompt Shield
Checks an agent's shell, file and network calls before they run
Why us
We've done this before. We have the receipts.
We've been shipping secure software for 40+ years. We've talked to over 100 CIOs and CISOs in the last year, and a leading Nordic insurer already runs on us — its CISO now owns AI risk with Atlas AI. It's the tool they kept asking for, ready before the EU's 2026 deadline.
GDPR
Already compliant · Certification in progress
SOC 2 Type II
Certification in progress
ISO 42001
Certification in progress
ISO 27001
Certification in progress
DORA
Aligned for regulated finance
NIS2
Certification in progress
Partners & backers
Partner of Microsoft for Startups and member of Tek Norge. Backed by Antler, Innovation Norway, StartupLab, Microsoft, and Tek Norge.
- Partner: Microsoft for Startups
- Member: Tek Norge
- Backer: Antler
- Backer: Innovation Norway
- Backer: StartupLab
What you get from a 4-week pilot
All AI use cases discovered — including the shadow AI no other vendor sees
Owners identified per use case, with explicit accountability
Risks classified across nine categories and the EU AI Act risk tier
Concrete remediation actions suggested and initiated, not just flagged
Automated four-framework coverage report (EU AI Act, NIST AI RMF, ISO 42001, OWASP LLM Top 10)
Continuous discovery keeps the view fresh — not a quarterly snapshot
AI governance, distilled
One short email a month: what changed in the EU AI Act, the prompt-injection patterns we're seeing in the wild, and one practical control you can ship this week.
No spam. Unsubscribe any time. Protected by reCAPTCHA.
What brings you here today?
Choose your path to get personalised recommendations
Put the controls inside your own boundary
Book a 30-minute call. We'll walk through what deploying into your tenant looks like, what it costs to run, and the question your board keeps asking: where exactly is our AI data going?
Running in your own Azure, AWS or GCP account, with the prompts and keys staying there
Every model call recorded with its owner and its cost, so the invoice stops being a surprise
Injection attempts and personal data stopped before they reach a provider