For the CTO and CISO

One control pointfor every model and agent.

Govern model access, protect sensitive data and keep AI architecture under control — without blocking the teams who want to use it.

The challenge

Model sprawl

Every team wiring up its own AI provider, keys and data flows.

Client identifiers and confidential documents pasted into public tools.

Autonomous tools reaching CRM, payments and email with no inventory or kill switch.

What you get

OpenAI, Anthropic and Google through one gateway; access and data limits by role; no keys in browsers.

Detection of client identifiers and your own patterns, with mask, hold or block before transmission.

A hash-chained audit trail with an integrity check, and evidence exports your auditors can test.

Third-party AI register with criticality, substitutability and exit plans.

Questions

Where does our data go?: Requests are checked on Dutira’s servers before anything is sent; approved requests go to the provider’s API with server-side keys. See the data-flow diagram on the security page.
How is data protected and isolated?: AES-256-GCM per organisation, forced row-level security in PostgreSQL, a hash-chained audit log and strict browser headers. Certifications are on the roadmap and not claimed.
Can we avoid lock-in to one model provider?: Yes: several providers run under the same policies, so use cases can move between approved models.

Dutira is not approved or endorsed by the FCA and does not guarantee regulatory compliance.

Architecture, security model and integration, with your engineers.