AI governance built for regulated teams
Decide which models each team can use, see sensitive details in prompts, and keep a signed record of every governance change.
New AI models arrive faster than approvals do
Engineers pick up new models with their own keys, often before procurement or risk have looked at them. Production data can reach a provider nobody approved, and the first you hear of it is a question from audit. In a regulated team, you want to answer that question with evidence, not recollection.
An approved list only helps if something checks it
A key and a few lines of code are enough to start a new AI workload. A written list of approved models is a policy. A check on every call is a control.
Sensitive details travel in prompts
Customer names, tax file numbers, card numbers and health identifiers can end up in prompts. Knowing how often, and from which workload, is the first step to a documented control.
Auditors ask for evidence, not intentions
A policy document says what you meant to do. A record of who changed which policy, and when, shows what you actually did.
Restrict models by team, and see every breach
Set which provider and model combinations are restricted for each team. Choose what happens when someone crosses the line: alert the team, warn the user, or block the request. Every breach is recorded with the team and the model, so the conversation with the owner starts from facts.
- Restricted lists set per team, with breaches recorded as they happen
- Three responses per policy: alert, warn or block
- When a policy says block, SDK requests are stopped before they reach the provider
Swipe to see all columns →
Example policies. Teams, models and responses are set in the console.
Example detections over 24 hours
See sensitive details in prompts, and mask them in the SDK
SAVI's scanner looks for personal and financial details such as names, email addresses, phone numbers and card numbers, including Australian tax file, business and Medicare numbers. Turn on masking in the SDK to hide what it finds before the prompt is sent. Each detection is recorded with its type and the action taken.
- Covers common personal and financial details, with Australian identifiers included
- Mask in the SDK before a prompt leaves your application, or flag it for review
- Each detection is logged with its type and the action taken
A signed record of every governance change
Every change to a governance setting is written to a log: who changed what, and when. Entries are signed, so an edit after the fact shows. Each AI call is also recorded with its model, team, cost and PII result. Both can be exported as JSON for your auditors.
- Who changed which policy, and when
- Signed entries, so changes after the fact can be spotted
- JSON export through the API, for audit and for your own tools
How the audit record works
A typical rollout
Start by watching, then enforce
Turn a policy on in alert mode first and see what it would have caught. When the results look right, move it to block. You never have to guess how a rule will land on a team.
- Alert mode records breaches without stopping anyone
- Move a policy to block when you are ready, one team at a time
- Every change is recorded, so the rollout itself becomes evidence
Send the signals to the tools your team already watches
SAVI shares its metrics in a form your existing monitoring tools can read, and can pass alerts to your security tooling. AI signals sit beside the rest of your monitoring, so nobody has to open a new dashboard to see them.
- Cost and usage metrics for the dashboards you already have
- Alerts passed on to your security tools
- Bring in AI traces you already collect
Where SAVI signals can go
Could you show your AI controls to an auditor tomorrow?
7 questions. Answer honestly.
Can you list every AI model that processed production data in the last 90 days?
Can you show which teams may use which models, and who approved it?
Do you know how often prompts contain customer personal details, and which workloads send them?
If audit asked for your AI activity record tomorrow, could you export it in a structured format within 24 hours?
Do you know which AI workloads are using models outside your approved list right now?
Could you show your board which AI controls you have, and where the gaps are?
If a customer asked you to delete their data, could you show that you had?
This checks one slice of your AI estate. Take the full AI Cost Ownership Assessment →
Your AI gap score
Answer to begin
Complete all questions to see your result
Know what your AI is doing, and show it.
SAVI restricts models by team, flags sensitive details in prompts, and keeps a signed record of governance changes. Book a demo and bring your hardest audit question.