AI was never the problem.
Deploying it without
sovereignty was.

OAIS (Optimized Artificial Intelligence Systems Inc.) builds AI sovereignty infrastructure for regulated enterprises. Its two products — Sentinel Core and Sentinel Guard — capture, block, govern, and optimise the AI interactions an organisation routes through them, creating a cryptographic chain of custody that is independently verifiable.

Sentinel Core is a cryptographic AI interaction registry. With one line of code, every AI interaction is HMAC-hashed with a key only the client holds, Ed25519-signed, Merkle-anchored (RFC 6962), and timestamped by an independent RFC 3161 authority. OAIS sees the fingerprint, never the content. Any third party can verify the entire chain without an OAIS account.

Sentinel Guard is a browser extension for shadow AI detection and data loss prevention. Deployed via Chrome Enterprise Policy or Intune, it detects AI tool usage across Chrome and Edge, enforces DLP rules before data leaves the browser, and feeds metadata records into the Sentinel Core registry. It is metadata-only by default — content capture is opt-in.

OSFI E-23, effective May 2027, requires enterprise-wide AI model risk management for all federally regulated Canadian financial institutions. Sentinel Core and Sentinel Guard produce the cryptographic audit evidence used to demonstrate control over AI interactions — tamper-evident records, independent timestamps, and exportable reports for any audit window. OAIS provides the auditability; the compliance determination remains with the institution and its auditors.

No. Sentinel Core hashes content with an HMAC key that only the client holds. OAIS sees the cryptographic fingerprint — never the content itself. Sentinel Guard is metadata-only by default; content capture is an opt-in configuration. The entire chain can be verified by any third party using a standalone script, without OAIS infrastructure access.

OAIS supports OSFI E-23 (mandatory May 2027 for Canadian federally regulated financial institutions), the EU AI Act (mandatory for AI systems in regulated European contexts), and ISO 42001 (the international standard for AI management systems). Sentinel provides the cryptographic auditability these frameworks require.

Sentinel Guard is deployed via Chrome Enterprise Policy or Microsoft Intune. It runs as a browser extension on Chrome and Edge, requiring no changes to existing AI tools or workflows. It detects AI usage, enforces DLP rules at the browser layer, and feeds records into the same Sentinel Core cryptographic registry.

Pricing is scoped to each deployment: number of AI systems monitored, interaction volume, integration complexity, and compliance objectives. Sentinel Core uses custom platform licensing. Sentinel Guard uses per-seat licensing with volume-based pricing. A 30-day pilot program is available. Every engagement starts with a scoping conversation.

Sentinel Core integrates with one line of code. The initial deployment — connecting one AI system and producing the first cryptographic audit record — can be completed in hours. A full enterprise rollout, covering multiple AI systems, configuring governance rules, and establishing compliance reporting, is typically scoped during a 30-day pilot engagement.

OAIS provides a standalone verification script that any third party can run — a regulator, external auditor, or internal compliance team. The script recalculates HMAC hashes, validates Ed25519 signatures, reconstructs the Merkle tree, and checks RFC 3161 timestamps against the independent timestamp authority. If any record has been modified, the verification fails. No OAIS account, API key, or infrastructure access is required.

Platform governance logging means the AI platform that generated the output also controls the log of that output. The log can be modified or selectively exported by the platform operator, and verification requires trusting the platform. Independent audit custody — what Sentinel provides — captures the audit record in a system architecturally separate from the AI platform. Records are cryptographically hashed, signed, Merkle-anchored, and independently timestamped. Any third party can verify the chain without trusting OAIS or the AI platform. For a detailed analysis, see our published research.

Yes. Sentinel Core integrates at the API layer and is agnostic to where the AI model runs. It works with cloud-hosted AI services (ChatGPT, Claude, Gemini), private cloud deployments, and on-premises models. The cryptographic hashing occurs locally, so interaction content never needs to leave the client environment regardless of deployment model.

Internal S3 WORM buckets create two severe enterprise compliance risks: First, the privacy trap: S3 Object Lock makes stored data permanently immutable. If employee prompts contain customer PII, account numbers, or Canadian Social Insurance Numbers (SINs), that data can never be deleted or redacted, directly violating PIPEDA and Quebec Law 25 statutory deletion mandates. Second, separation of duties: Having internal cloud admins manage the log bucket fails OSFI E-23 independent audit custody requirements. Sentinel solves both: content is hashed in-memory with a client-held HMAC salt before storage—zero plaintext is ever locked—and Merkle tree roots are anchored to public accredited TSAs (Sectigo and DigiCert) for true independent verification.

Model providers have an inherent structural conflict of interest: asking an AI platform to audit its own hallucinations, bias, or data leakage violates regulatory segregation of duties. Furthermore, enterprise banks operate multi-cloud estates (Bedrock for developers, Azure OpenAI for Copilot, Google Cloud for search, and on-premises GPUs). Microsoft will not audit Bedrock; AWS will not audit Azure. Sentinel serves as a vendor-neutral, universal cryptographic audit plane across all foundation models.

Your compliance evidence is contractually protected and architecturally independent. The standalone offline verifier is open-source Apache 2.0 and executes on standard Python standard library with zero network calls. Timestamp anchors are held by independent commercial certificate authorities (Sectigo and DigiCert)—not OAIS. In addition, an independent escrow trustee releases full database exports and source code upon any cessation event, guaranteeing your records remain permanently verifiable for the statutory 7-year retention period under OSFI E-23.

OSFI does not evaluate whether an institution deployed governance software the day before May 1, 2027. Examiners evaluate the historical lifecycle evidence of models already operating in production. If an institution deploys generative AI in 2025 and 2026 without an immutable audit trail, it accumulates massive regulatory debt that cannot be retroactively fixed, guaranteeing a Material Finding during supervisory review. A 30-day sandbox pilot today establishes the baseline evidence trail ahead of OSFI's 2026 exploratory check-ins.