AI Control Tower

AI Control Tower is an open-source, self-hosted platform for governing enterprise AI usage. It gives organizations a single control plane over how employees interact with AI tools — without sending any data to external SaaS providers. The problem it solves is what the industry now calls "Shadow AI": employees quietly using ChatGPT, Claude, Midjourney, or locally-installed LLMs to do their work, often pasting confidential data, source code, customer information, or credentials into external tools. Most companies have no visibility into this, no policy enforcement, and no audit trail — which makes compliance with regulations like the EU AI Act, ISO 42001, or NIST AI RMF effectively impossible. AI Control Tower closes that gap with three integrated layers. GOVERNANCE & COMPLIANCE A Policy Center lets teams author, version, and approve AI usage policies as structured JSON rules. Every AI request is registered in a Usage Registry with its purpose, risk level, and full request-to-response trace. Requests requiring sign-off are routed through an approval workflow with designated approvers. Every mutation in the platform is written to an immutable audit log, queryable at any time. A Connections module (Vendor Risk Desk) manages provider credentials for OpenAI, Anthropic, Azure OpenAI, or any custom HTTP endpoint, with SLA tracking and risk scoring. Credentials are encrypted at rest using Fernet. PROMPT FIREWALL Before any prompt leaves the organization, the firewall automatically masks PII — emails, credit card numbers, SSNs, phone numbers, IP addresses, API keys — using a combination of regex patterns and optional named-entity recognition. Policies can also block specific terms or substrings entirely, rejecting the prompt before it reaches the provider. The result: the AI provider never sees raw, unmasked input. SHADOW AI MONITOR Unauthorized AI usage is detected through two complementary channels. A passive network sniffer discovers DNS queries, TLS SNI, DHCP leases, and ARP data on a span port or mirrored interface — giving visibility into cloud AI tools without installing anything on employee devices. A lightweight Go endpoint agent detects locally-running AI tools like Ollama, vLLM, or LM Studio by scanning processes, listening ports, and model weight files on disk. A Manifest V3 browser extension adds a third layer: it flags visits to known AI services and warns users before they paste secrets into a web interface. All findings are classified against a per-organization allow/block/unknown domain catalog, deduplicated into sightings, and can be converted into sanctioned providers or dismissed with one click. Discovery is strictly read-only — no anonymous auto-attach, no ARP spoofing, no forged packets. MLOPS LAYER For teams training and serving their own models, the platform includes a full MLOps workflow. A Dataset Manager handles CSV, TSV, and JSON uploads. A Compute Detector snapshots CPU, RAM, disk, GPU, and VRAM to gate which models can be trained on the current hardware. The Training Service supports both scikit-learn (tabular classification and regression) and Hugging Face Transformers (text classification and generation) via Celery, with a per-job prediction API and downloadable artifacts. Deployments serve trained models through a chat playground. A separate RAG service builds knowledge bases from PDF, DOCX, and TXT documents and answers questions over them without any fine-tuning — using TF-IDF by default and upgrading to neural embeddings automatically if the optional ML stack is installed. A Simple Mode wizard walks non-technical users from "what should the model do?" to a working model, automatically choosing RAG vs. fine-tuning based on the uploaded data. TECHNICAL STACK Backend: FastAPI, Pydantic v2, SQLAlchemy 2 (async), asyncpg, Alembic, Celery 5, Redis 7, PostgreSQL 16. Frontend: Next.js 16, React 19, TypeScript, axios, i18next (English and Uzbek). Endpoint agent: Go 1.21+ (stdlib only, plus golang.org/x/net for DNS parsing). Browser extension: Chrome Manifest V3 (vanilla JavaScript). Deployment: Docker Compose with systemd units for production, or a single docker-compose up for local development. SECURITY MODEL Postgres and Redis bind to 127.0.0.1 only. The backend and frontend are the only externally reachable services. Collectors authenticate with machine keys (X-Ingestion-Key) tied to an Ingestion Source, never with user JWTs, and keys are stored hashed. The endpoint agent runs as an unprivileged user; ARP and DHCP discovery are gated behind a single CAP_NET_RAW capability that is probed at runtime. The browser extension reports only that sensitive data was detected (type and label), never any fragment of the value itself, and does not send full page URLs.