Shadow-AI discovery.
- What it does and why it matters
Finds the AI tools and services in use at every connected boundary and builds your inventory of approved and unapproved AI use.
// Athena
Accountability for AI and automated decisions.
See what your AI accessed, control what it does and prove both. Athena has four modules for connected models, copilots, agents and automated decision systems: Data Control, Secure Runtime, Sovereign Compliance and Algo Assurance.
Data Control governs what crosses a connected AI boundary. Secure Runtime governs consequential AI actions at connected enforcement points. Sovereign Compliance turns their records into tamper-evident evidence that an authorised party can verify offline. Algo Assurance keeps algorithmic decisions about people in human hands and keeps the proof. Customers select the modules and scope they need in writing.
// Athena
How Athena works.
- Connect
At the model, agent, tool-call, API, proxy, SDK, CLI or webhook boundary.
- Inspect
The actual payload, destination, action, arguments, identity, authority and policy at that point.
- Control
Allow, redact, block, hold for a named person or refuse, according to your policy. Fails closed.
- Record
The decision, its context and the observed outcome, as the event happens.
- Seal
Add integrity, identity, time, custody, coverage and mapping information and sign the record with ML-DSA-65.
- Verify
Your auditor checks the record offline, with no account and no connection to us.
Athena applies the selected controls at the integration points agreed for a workflow. Signed records use ML-DSA-65 over a canonical form (RFC 8785) and can be checked by an authorised verifier. Verification establishes specified record integrity and conformance properties, not the truth, fairness or legality of the underlying event.
Connectivity and coverage depend on the deployment and interfaces agreed during scoping.
// 01. Athena
Athena Data Control.
Question answered: What information is AI receiving, sending or exposing?
Your data-loss tools were built for email and files, not prompts and agent actions. Athena Data Control operates at each AI or API boundary you connect. It observes the payload and destination presented at that boundary, applies the configured policy and records its decision before the connected transfer proceeds.
Data classification.
- What it does and why it matters
Identifies secrets, personal data, source code, regulated fields and business-confidential information before release. It catches business-confidential language that carries no personal data at all, such as financials, deal terms and trade secrets, the class pattern-matching tools score near zero on. Credentials, crypto addresses and special-category personal data such as health, beliefs and biometrics are routed to a person for review.
DLP inspection.
- What it does and why it matters
Evaluates the actual outbound payload, not a user, application or destination label. Athena is evasion-hardened: it scans decoded, case-folded and delimiter-stripped views of the text alongside the raw payload, and corroborates secrets by their structure, such as check digits and address encodings, rather than by keyword lists.
Egress boundary.
- What it does and why it matters
Applies model-, provider-, destination- and data-specific policy to allow, redact or block a transfer. When a safe decision cannot be made, the transfer does not proceed. The gate fails closed.
Redaction and masking.
- What it does and why it matters
Removes or replaces sensitive elements while allowing the permitted part of the task to continue. This preserves useful AI access without exposing unnecessary detail.
Fingerprint and canary controls.
- What it does and why it matters
Fingerprints known values and mints honeytokens, so a later appearance of protected material is traced back to its source. Leaks are proven and attributed, not guessed.
Credential firewall.
- What it does and why it matters
For traffic routed through the configured credential proxy, real keys and tokens can be injected at the boundary rather than placed in the prompt or agent process.
Proof of what crossed.
- What it does and why it matters
Records what the connected boundary observed leaving, the stated destination, which policy applied and whether it was allowed, redacted or blocked. The agreed evidence profile minimises sensitive content and is reviewed for disclosure and low-entropy-data risks.
Data-residency evidence.
- What it does and why it matters
Records the configured processing region and transfers observed at the connected boundary, including the stated model, provider and jurisdiction.
Customer outcome: The organisation can use AI while retaining control over which information reaches which model, provider or jurisdiction.
// 02. Athena
Athena Secure Runtime.
Question answered: What is AI doing, under whose authority and within which limits?
Athena Secure Runtime governs connected model, copilot and agent actions at the point where they call a tool, invoke an API or make another consequential change. It checks the exact submitted action against the approval's actor, resource, arguments, time and permitted-use scope before execution. The control decision and the outcome reported by the receiving system are recorded as observations, not as proof of external truth.
Human approval.
- What it does and why it matters
Holds consequential actions for a named person when your policy requires it. The exact action and arguments the person approved are bound to the action submitted for execution, so any drift between approved and executed is caught and refused.
On-behalf-of authority.
- What it does and why it matters
Records the person or organisation for whom the AI was acting, alongside the agent identity. This answers whose authority applied rather than naming only the automated process.
Scope and permission gate.
- What it does and why it matters
Checks whether the proposed tool, endpoint, action and arguments fall within the authority granted for the workflow. Athena reads each tool's own schema, so the gate knows which field is a destination, which is a payload and which is a credential sink. Insufficient scope or evidence means refusal.
Tool-call control.
- What it does and why it matters
A configured checkpoint for consequential tool calls routed through the supported interface. It can control data leaving through those calls as well as through connected chat paths.
API security.
- What it does and why it matters
Restricts outbound API calls by destination, method, argument and any other policy-relevant detail.
Kernel-level confinement.
- What it does and why it matters
Adds an operating-system boundary beneath the application gate for the processes and resources included in the deployment, providing a separate enforcement layer rather than a universal bypass guarantee.
Instant block and stop controls.
- What it does and why it matters
Stops a prohibited or unapproved action immediately. You hold the switch.
Undo and rollback.
- What it does and why it matters
Restores the prior state where the target system exposes a safe reversal, and records the recovery action rather than erasing history.
Code-integrity evidence.
- What it does and why it matters
Records what a coding agent changed, under whose authority, and the integrity of what shipped.
Sealed action record.
- What it does and why it matters
Records what was proposed, held, approved, allowed, refused, blocked and observed as executed, with the identity, authority and policy context.
Customer outcome: AI can take useful action while consequential operations routed through the configured enforcement points remain subject to the agreed human and policy authority.
// 03. Athena
Athena Sovereign Compliance.
Question answered: Can an authorised third party verify the evidence without trusting the vendor that created it?
Logs are not evidence. Athena Sovereign Compliance converts Data Control, Secure Runtime and Algo Assurance records into tamper-evident, audit-ready evidence. You keep the data, the keys, the logs and the evidence. Anyone you authorise checks the record offline.
Continuous evidence capture.
- What it does and why it matters
Captures data and action events routed through the configured workflow, with coverage and gaps stated so later review does not assume events outside the connected path were recorded.
Tamper-evident records.
- What it does and why it matters
Seals every record so that any change to its signed content invalidates the signature, including a change made by Aelethion.
Post-quantum-capable sealing.
- What it does and why it matters
Seals evidence with ML-DSA-65, the NIST post-quantum signature standard (FIPS 204). Long-term verification depends on retained trust material, key custody, implementation security and migration as standards evolve.
Independent offline verifier.
- What it does and why it matters
A free, public verifier lets anyone you authorise check a record on their own machine. No account, no network, no call to us.
Evidence packs.
- What it does and why it matters
Bundles the records, control context, coverage and supporting material for audit, investigation, customer assurance and regulatory review.
Regulation and control mapping.
- What it does and why it matters
Maps selected record fields to specified controls across supported framework profiles and represents the mapping in OSCAL, with coverage and gaps kept visible.
Coverage and gaps.
- What it does and why it matters
Shows what each record supports, what passed, what failed and what remains open.
GRC and API export.
- What it does and why it matters
Exports records and mappings in OSCAL, and as a DORA Register of Information, into your existing GRC, audit and SIEM tools.
Chain of custody and trusted time.
- What it does and why it matters
Preserves identity, sequence, custody and time information needed to reconstruct the evidence path.
Retention and re-attestation.
- What it does and why it matters
Re-seals evidence on the retention schedule you define, so long-lived records stay checkable under current keys and algorithms.
Athena does not ask the AI whether an action was safe. A policy engine checks the submitted action against the configured rules and binds the result into the record for offline verification. That check establishes conformance to the specified policy; it does not prove the policy is complete, fair or legally sufficient.
Athena does not grade its own homework. Its risk models learn from your people's decisions, never from the model's own account of itself.
Check it yourself.
Install the free verifier, run it on one of our sealed records, and watch it pass. Change a signed value and watch it fail. No network, no account, no trust in us.
Customer outcome: Evidence can be handed to an auditor, regulator, insurer, board or customer and checked independently.
// 04. Athena
Athena Algo Assurance.
Question answered: Who took this decision about a person, on what information, and can you prove it?
Athena Algo Assurance governs algorithmic decisions about people. When a system proposes to suspend an account, end a contract or change pay, Algo Assurance holds the decision for a named person, records the reasons and seals the proof.
It is built for the EU Platform Work Directive (Directive (EU) 2024/2831), which Member States must transpose by 2 December 2026. Once it is in national law, a human being must take every decision to restrict, suspend or terminate a platform worker’s account or contract (Article 10(5)). The rule covers systems that take a decision and systems that only support one, and it applies whether or not the worker is an employee.
A platform must be able to show three things: that a human took the decision before it took effect, that the review was meaningful, and that the worker was told why, on time. The Dutch data protection authority’s guidance Meaningful Human Intervention sets the standard for that review: the reviewer is competent, has the information, is allowed to overrule the outcome and can influence the decision before it has significant consequences for the person.
Decision inventory.
- What it does and why it matters
Lists each automated system that takes or supports a decision about a person, and which decisions restrict, suspend or terminate an account or contract, or affect pay or contractual status.
Prohibited-data checks.
- What it does and why it matters
Checks the data a system uses about a worker against the categories the Platform Work Directive prohibits, including emotional or psychological state, private conversations and data collected while the person is not working (Article 7).
Impact-assessment evidence.
- What it does and why it matters
Supplies the system inventory and decision records your data protection impact assessment draws on (Article 8).
Transparency record.
- What it does and why it matters
Keeps the statement of which systems are in use, what they decide and their main parameters, and shows what workers and their representatives were told and when (Article 9).
Human decision.
- What it does and why it matters
Holds every decision to restrict, suspend or terminate an account or contract for a named person before it takes effect. Urgent fraud and safety cases follow a defined route that still ends in a human decision (Article 10(5)).
Reviewer information and authority.
- What it does and why it matters
Shows the reviewer the information the system used and lets them confirm, change or overrule the outcome. What they saw, what they decided and the reasons they gave are recorded (Article 10).
Reasons and review.
- What it does and why it matters
Records the written statement of reasons given to the worker by the day the decision takes effect, and tracks the two-week deadlines for the review reply and for correcting a wrong decision (Article 11).
Oversight evaluation.
- What it does and why it matters
Provides the decision data for the evaluation of automated decisions that platforms carry out with workers’ representatives at least every two years (Article 10).
Proof.
- What it does and why it matters
Seals who decided, when, on what information and what the worker was told into a tamper-evident record that a court, regulator or auditor can verify offline.
The directive has no record-keeping article. The sealed record is your proof that the human review happened, for a court that orders disclosure under Article 21 or an authority that asks under Articles 9 and 10. Scope, worker status, the national transposing law and the substance of each decision remain with you and your counsel.
Customer outcome: Every consequential decision about a worker is taken by a person with the authority to change it, and you can show a regulator or a court exactly how it was made.
// Athena
One evidence chain.
Data Control, Secure Runtime and Algo Assurance create the operational record. Sovereign Compliance converts that record into independently verifiable evidence, connecting the data used, the authority asserted, the approval, the action, the control result and the observed outcome from the receiving system, in one chain.
This avoids the common problem of trying to reconcile separate logs, screenshots and exports after an incident or during an audit.
// Athena
Deployment and integration.
Athena runs hosted in an EU region, in your own cloud, on-premise or air-gapped. Air-gapped, it runs with local model weights and makes no external connection at all.
Depending on the selected deployment, Athena can connect through agreed model APIs, AI gateways, proxies, agent runtime hooks, MCP and other tool-call interfaces, application APIs, SDKs, CLIs, webhooks, key stores and evidence or GRC systems. Each connection and its coverage are confirmed during scoping.
Athena complements existing DLP, SIEM, identity, secrets-management, GRC, audit and model-governance systems. It adds control and evidence around the chosen AI stack rather than forcing the organisation to replace it.
// Athena
Customer control.
You choose where Athena runs. You hold the data, the infrastructure, the logs, the keys and the evidence. Every connection, privilege, update path, support path and exit procedure is documented before production.
Signing keys are generated and held inside your boundary. Aelethion holds no master key that could create evidence in your name. Offline verification takes Aelethion out of the evidence-checking path entirely.
Start with one real workflow.
Choose a valuable workflow that needs stronger control or a provable human decision. We will agree the relevant Athena modules, integration boundary, evidence limits, acceptance tests, timetable and commercial scope in writing.