Cryptographic AI Governance, PII Air-Gapping & EU AI Act Audit Ledgers
Resvanta Sentinel TrustOS (`sentinel.resvanta.com`) is a sub-15ms inline AI runtime firewall and cryptographic compliance ledger. It intercepts enterprise LLM traffic before external egress to redact PII/PHI, block prompt injections, enforce human-in-the-loop approval gates, and sign every interaction into an immutable SHA-256 Merkle tree & Ed25519 audit log.
Why Policy PDFs and Mutable Database Logs Fail Regulatory Audits
Employees and autonomous agents routinely paste customer SSNs, patient records, and proprietary credentials into third-party LLM APIs without format-preserving tokenization.
Standard relational database or cloud application logs can be altered retroactively by administrators, failing strict non-repudiation requirements during incident investigations.
Sentinel intercepts every prompt inline (<15ms P99 overhead), vaults sensitive tokens locally, and chains every policy decision into an Ed25519-signed Merkle ledger.
Deterministic Tokenization Before External API Call
Replaces names, SSNs, MRNs, IBANs, and API keys with reversible local synthetic tokens (`[PII_PERSON_8F2A]`) before the payload leaves your VPC.
Prompt-Injection Defense & Tool-Call Risk Gating
Evaluates tool invocations against role-based risk tiers—automatically pausing high-risk actions (e.g., wire transfer, schema drop, external email) for human sign-off.
Tamper-Evident Cryptographic Audit Chain
Hashes prompt/response metadata, policy version, and operator approval into an append-only SHA-256 Merkle tree signed with Ed25519 keys.
EU AI Act Annex IV, DORA & ISO 42001 Evidence Exports
Exports machine-verifiable JSON/PDF audit dossiers mapping runtime enforcement logs to EU AI Act Articles 9–15, DORA ICT controls, and HIPAA Safe Harbor rules.
- • Inline Reverse-Proxy & SDK: Drop-in enterprise LLM REST API compatible proxy gateway with deterministic PII/PHI regex + NER redaction and local token vaulting.
- • Cryptographic Audit Ledger: Append-only Write-Ahead Log (WAL) with SHA-256 Merkle root chaining, Ed25519 signatures, and one-click integrity verification.
- • Human-in-the-Loop Kill-Switch: Configurable risk-tier thresholds requiring cryptographic operator approval for high-impact agent tool calls.
- • Proxy Latency Benchmark (Oct 2026 Internal Validation, n = 10,000 prompts): Measured across n = 10,000 inspected prompts (2KB median payload) on a 4-vCPU gateway node. Inline PII redaction + Merkle/Ed25519 signing overhead is median 8.4ms, P95 11.8ms, P99 14.6ms (excluding upstream LLM token generation latency).
- • Compliance Alignment vs. Legal Certification: Sentinel TrustOS provides technical enforcement controls and cryptographic audit trails aligned to EU AI Act, DORA, HIPAA, and ISO/IEC 42001 control frameworks. Deploying software does not by itself constitute third-party legal or accredited auditor certification.
2 HA Gateway Nodes, up to 25 Active Agents, 60M Fast-Path + 10M Deep-Semantic tokens/mo, and 7,500 STC/yr (Tier 0 Starter at US$18,000/yr; Standalone Point SKUs from US$24,000/yr).
6 Multi-VPC Nodes, up to 100 Active Agents, 250M Fast-Path + 40M Deep-Semantic tokens/mo, 25,000 STC/yr, 6 Sealed Dossiers/yr, and Unlimited CycloneDX 1.5 A-SBOMs.
MSSP Partner Franchise ($48k / $95k Base + Wholesale Blocks) or Sovereign Defense TEE Fleet at US$380,000/yr (Option 1 Client Self-Hosted BYOC) | US$425,000/yr (Option 2 Resvanta-Managed Single-Tenant VPC).