Enterprise AI
Governance & Compliance
Centralized oversight of AI systems, agents, and API usage. Track risk, compliance, shadow AI, and costs across your organization.
Everything you need to govern AI
From shadow AI discovery and data-leak probing to approvals, alerts, and executive dashboards, UrNammu covers the full governance lifecycle.
AI System Registry
Maintain a centralized inventory of every AI system in your organization, with ownership, risk level, lifecycle status, and approval tracking.
Approval Workflows
Staged Owner, Security, Legal, and Compliance sign-off with recorded rationale, plus time-bound exceptions, evidence artifacts, and governance incidents kept next to each system.
Agent Governance Lifecycle
Charter, approve, run, review and retire autonomous agents, with every control enforced at the proxy: a kill switch that stops traffic, MCP allowlists, human-review triggers that hold a tool call until a person approves it, behaviour baselines, and a six-dimension posture score.
Frameworks & EU AI Act
A seeded catalog of NIST AI RMF, ISO/IEC 42001, EU AI Act, and SOC 2 controls with cross-framework inheritance, plus a classification wizard that derives each system’s EU AI Act tier and obligations.
Risk Center
Multi-dimensional risk scoring across bias, security, privacy, fairness, performance, and transparency with interactive heat maps and agent-aware overlays.
Shadow AI Discovery & Enforcement
Detect unregistered AI tools across Google Workspace, Microsoft 365, Hexnode devices, CrowdStrike Falcon, DNS / proxy / Netskope logs, and the endpoint agent, matched against a 164-tool registry. Then block for real: a blocklist feed for your network controls and app-disable at the identity provider.
Endpoint Agent
An installable agent for managed Macs and Windows machines that reports the AI apps, sites and local model servers a device actually uses — covering the off-VPN laptops and loopback inference no network or vendor API can see. Identifiers and counts only, never prompts or URLs.
Sensitive Scan & Inline DLP
Probe your AI gateways for system-prompt, credential, and PII leakage on a schedule, and inspect live proxy traffic in both directions for secrets, exfiltration attempts, and pasted sensitive data.
Policy-as-Code & Compliance
Enforce machine-readable policy rules at the proxy (off / dry-run / enforce), assess systems control by control with evidence and coverage roll-ups, and review every block in the Policy Denials log.
Alerts & Key Usage Rules
One inbox for every governance signal source, tunable dangerous-prompt rules with false-positive handling, and key usage rules that catch a leaked or misused API key by how it behaves.
AI Oversight & Provider Security
Monitor usage, budgets, costs, and anomalies across provider admin APIs, AI gateways, and Gemini / Vertex billing, with cost attributed to the API key, system, and workspace that spent it. Audit each provider’s security and privacy posture and grade it A to F.
Developer AI Dashboards
Per-surface telemetry for Claude Platform / API, Claude Code, Cowork, Cursor, and GitHub Copilot, and session traces that replay a session as a waterfall of turns, model calls, and tool use — with the proxy’s view alongside.
Usage by Person & Directory Sync
One row per person, totalled across every AI surface, with identity resolved from Google Workspace or Microsoft Entra ID so aliases collapse, departments roll up, and usage after someone leaves raises an alert.
Custom Reporting
Build governance reports from templates, export to PDF / CSV / JSON, and schedule recurring email delivery for boards and auditors.
See it in action
A mission-control interface built for governance teams
Command Center — Real-time governance posture overview
Risk Center — Multi-dimensional risk assessment heat map
Framework Coverage — Seeded control catalog with crosswalk inheritance
Agent Governance — Posture score, checklist and charter for one agent
Human Review — A tool call held at the proxy until a person decides
MCP Tool Governance — Allowlists and observed tool activity per agent
Sensitive Scan — Leakage probes and inline response DLP findings
Session Traces — A developer session replayed with the proxy’s view of each call
Reports — Templated, exportable, schedulable governance reporting
Developer AI Oversight — Per-surface usage, cost, and telemetry
Usage by Person — One row per colleague, totalled across every AI surface
GitHub Copilot — Seats, accepted lines, and acceptance rate by feature and IDE
Directory Sync — Identity, aliases, and departments from your IdP
Endpoints — What each managed machine actually runs and reaches, including local models
Built on modern foundations
Enterprise-grade stack with security, performance, and developer experience in mind.
Next.js 16 + React 19
App Router with server components, Turbopack, and edge-ready deployment on Vercel.
PostgreSQL + Prisma
Type-safe database access with full migration support. 50+ data models covering governance, telemetry, and identity.
Provider-Agnostic AI
Anthropic Claude or OpenAI for risk classification, gap analysis, and agent reviews — with a transparent proxy in front of Anthropic, OpenAI, Azure OpenAI, Gemini, and Bedrock that enforces policy, MCP allowlists, agent kill switches, human-review triggers, and DLP on every call.
Enterprise Auth
Google OAuth, Microsoft 365, and local accounts. Role-based access control with Admin, Compliance Officer, and Viewer roles.
Built for the frameworks you are measured against
96 seeded controls across four frameworks, with 107 curated crosswalk links so an assessment recorded once can inherit everywhere it applies.
EU AI Act
Classify each AI system’s EU AI Act risk tier, derive the obligations that follow, and evidence them control by control against 19 seeded articles.
EU AI Act Compliance Software → 19 controlsNIST AI RMF
Operationalise the NIST AI Risk Management Framework: 19 seeded controls across Govern, Map, Measure and Manage, assessed per system with evidence.
NIST AI RMF Software → 38 controlsISO/IEC 42001
Run an ISO/IEC 42001 AI management system on real data: 38 seeded Annex A controls assessed per system, with evidence, coverage roll-ups and an audit trail.
ISO 42001 Compliance Software → 20 controlsSOC 2
Bring the AI estate into SOC 2 scope: 20 seeded Trust Services Criteria per system, with access, change and monitoring evidence produced by the proxy.
SOC 2 Compliance for AI Systems →