Prove what your AI did.

OAIS (Optimized Artificial Intelligence Systems Inc.) builds AI sovereignty infrastructure for regulated enterprises. Its two products — Sentinel Core and Sentinel Guard — capture, block, govern, and optimise the AI interactions an organisation routes through them, creating a cryptographic chain of custody that is independently verifiable.

Sentinel Core is a cryptographic AI interaction registry. With one line of code, every AI interaction is HMAC-hashed with a key only the client holds, Ed25519-signed, Merkle-anchored (RFC 6962-style), and timestamped by an independent RFC 3161 authority. OAIS sees the fingerprint, never the content. Any third party can verify the entire chain without an OAIS account.

Sentinel Guard is a browser extension for shadow AI detection and data loss prevention. Deployed via Chrome Enterprise Policy or Intune, it detects AI tool usage across Chrome and Edge, and enforces DLP rules before data leaves the browser. Policy checks run in the browser or against an evaluation service the organisation configures. Integration with the Sentinel Core registry is in development.

OSFI E-23, effective May 2027, requires enterprise-wide AI model risk management for all federally regulated Canadian financial institutions. Sentinel Core and Sentinel Guard produce the cryptographic audit evidence used to demonstrate control over AI interactions — tamper-evident records, independent timestamps, and exportable reports for any audit window. OAIS provides the auditability; the compliance determination remains with the institution and its auditors.

No. Sentinel Core hashes content with an HMAC key that only the client holds. OAIS sees the cryptographic fingerprint — never the content itself. Sentinel Guard sends prompt text only to the policy evaluation service the organisation configures. The chain can be verified by a third party with OAIS’s standalone verifier, without access to OAIS infrastructure.

OAIS supports OSFI E-23 (mandatory May 2027 for Canadian federally regulated financial institutions), the EU AI Act (mandatory for AI systems in regulated European contexts), and ISO 42001 (the international standard for AI management systems). Sentinel provides the cryptographic auditability these frameworks require.

Sentinel Guard is deployed via Chrome Enterprise Policy or Microsoft Intune. It runs as a browser extension on Chrome and Edge, requiring no changes to existing AI tools or workflows. It detects AI usage and enforces DLP rules at the browser layer.

Pricing is scoped to each deployment: number of AI systems monitored, interaction volume, integration complexity, and compliance objectives. Sentinel Core uses custom platform licensing. Sentinel Guard uses per-seat licensing with volume-based pricing. A 30-day pilot program is available. Every engagement starts with a scoping conversation.

Sentinel Core integrates with one line of code. The initial deployment — connecting one AI system and producing the first cryptographic audit record — can be completed in hours. A full enterprise rollout, covering multiple AI systems, configuring governance rules, and establishing compliance reporting, is typically scoped during a 30-day pilot engagement.

OAIS provides a standalone verification script that any third party can run — a regulator, external auditor, or internal compliance team. The script recalculates HMAC hashes, validates Ed25519 signatures, reconstructs the Merkle tree, and checks RFC 3161 timestamps against the independent timestamp authority. If any record has been modified, the verification fails. No OAIS account, API key, or infrastructure access is required.

Platform governance logging means the AI platform that generated the output also controls the log of that output. The log can be modified or selectively exported by the platform operator, and verification requires trusting the platform. Independent audit custody — what Sentinel provides — captures the audit record in a system architecturally separate from the AI platform. Records are cryptographically hashed, signed, Merkle-anchored, and independently timestamped. Any third party can verify the chain without trusting OAIS or the AI platform. For a detailed analysis, see our published research.

Yes. Sentinel Core integrates at the API layer and is agnostic to where the AI model runs. It works with cloud-hosted AI services (ChatGPT, Claude, Gemini), private cloud deployments, and on-premises models. The cryptographic hashing occurs locally, so interaction content never needs to leave the client environment regardless of deployment model.

Two problems. First, privacy: Object Lock makes stored data immutable. If prompts contain customer personal information, account numbers or Social Insurance Numbers, that data cannot be deleted or corrected, which makes PIPEDA and Quebec Law 25 obligations hard to meet. Second, independence: when the same team runs the AI platform and controls its logs, the record is not independent of the system it describes, and model risk reviews look for that separation. Sentinel addresses both: content is fingerprinted with a client-held HMAC key before anything is stored, so no plaintext is locked away, and Merkle roots are timestamped by independent authorities (Sectigo and DigiCert).

Model providers have an inherent structural conflict of interest: asking an AI platform to audit its own hallucinations, bias, or data leakage violates regulatory segregation of duties. Furthermore, enterprise banks operate multi-cloud estates (Bedrock for developers, Azure OpenAI for Copilot, Google Cloud for search, and on-premises GPUs). Microsoft will not audit Bedrock; AWS will not audit Azure. Sentinel serves as a vendor-neutral, universal cryptographic audit plane across all foundation models.

Your evidence does not depend on OAIS staying in business. Timestamp tokens are issued by independent authorities (Sectigo and DigiCert), not OAIS, and OAIS provides a standalone verifier that your auditors can run offline against an exported evidence bundle.

OSFI does not evaluate whether an institution deployed governance software the day before May 1, 2027. Examiners evaluate the historical lifecycle evidence of models already operating in production. Evidence that was never captured cannot be recreated later. An institution that runs generative AI through 2026 without a tamper-evident record will have a gap in its history when supervisory review begins. A 30-day pilot establishes the evidence trail now, ahead of the May 1, 2027 effective date.