AISO checks every AI request against the person asking and the model answering. Restricted data only reaches models you cleared, and every decision is logged.
Sources: Gartner 2026 survey of 186 organisations, as summarised by Opsin; a16z, survey of 100 CIOs, January 2026.
51%
In Gartner’s 2026 survey of Copilot customers, 51% named oversharing and data loss as the top barrier to rollout. An assistant that reads whatever file permissions allow inherits every permission mistake ever made.
81%
Most assistants run in the vendor’s cloud, on the vendor’s models. Yet 81% of large companies already use three or more model families.
Chat, the agent builder and the coding assistant each arrive with their own console, so nobody can say who sent what to which model.
Single sign-on through Microsoft Entra ID, Google Workspace, Okta or any OIDC provider, with SCIM so the directory creates and retires accounts.
Admin, builder and member, plus custom roles that only ever add. Any agent, workflow, knowledge store or tool can name who may use it.
Documents, tables and folders of code carry a level, and each request is checked against the person’s clearance and the model’s ceiling.
Each person gets a chat built from what they may use. Ask for something outside it and Chat says what’s missing, then offers to ask the owner, who can grant that one resource and nothing more.
Whatever surface it came from, in this order. A refusal names its reason.
Three kinds of user, one policy layer.
In the Studio, Slack, Teams or email, with knowledge search reading only what the person’s clearance and the model’s ceiling both allow.
Agents and knowledge stores in a visual composer, or YAML in the built-in IDE. Tools that change data stay off until an admin allows them, and each use then waits for approval.
Claude Code, Codex, OpenCode, Copilot chat, Continue, Cline and JetBrains reach models through AISO, as the developer. Code from a classified folder is refused on cloud models, whichever tool sent it.
Its model, prompt, tools, output schema and memory sit in one YAML file. Pin the model and no vendor update can change it under you. Changing it becomes a release you approve.
Every number in a reply is matched against the query results that produced it, and any figure it can’t trace is named under the reply.
Snowflake, Databricks, Power BI, dbt, Looker and Tableau answer through each vendor’s own MCP server, signed in as the person. Their row and column rules still apply. Nothing is copied into a second index.
A kept answer is signed with the results it used and verifies offline. Re-run asks each source again and reports what changed.
Pick a date range and export the compliance report, policy version, limits, usage and audit log as one file.
No telemetry. With the cloud-model lock on, a restricted site’s AI traffic stays inside the building.
Every field of every audit row is hashed into a chain, so an edit after the fact shows.
MLX Serve is our open-source inference engine. AISO doesn’t need it and runs just as well on Ollama, LM Studio, any OpenAI-compatible server or a cloud provider on your key. On a Mac, the two are built to work together.
Measured against LM Studio, oMLX and MTPLX on identical weights, every run committed with the harness that produced it. On a few models it ties, and those rows are in the table too. Read the benchmarks or visit mlxserve.com.
We are running a pilot with a public sector critical infrastructure operator. The question is whether local AI can read operational log data and produce a root cause analysis worth trusting. The logs never leave their network.
It is an evaluation, not a deployment, and we are not claiming a result yet. We will publish what we learn, including if the answer turns out to be no.
We agree on success criteria before we start. If we don’t deliver a working AI workflow that meets them within two weeks, you get your money back.
Book a Demo