Moftgate AI

Moftgate has two AI surfaces. The first governs the AI your employees use: which tools are in use, what is sent to them, and what to do about it. That is covered in the AI governance guide. The second is the analysis the platform itself performs on the records it already holds.

This page describes the second surface and the data sovereignty model that applies to both. It documents what is available in the shipped release, and it marks clearly which capabilities are still on the roadmap.

The agent runs a local proxy on the endpoint. When a request goes to a known AI service, the proxy extracts the prompt text, the model name when the service reports it, and any uploaded file name. Extraction works across JSON bodies, multipart form data, and URL-encoded forms.

The policy decides what happens to the request. The action is configured per policy in the AI platforms channel of DLP policies.

AI Activity Logs is the forensic view for AI prompt and upload activity. It sits under the DLP menu and answers the question auditors actually ask: who sent what, to which AI service, and what did we do about it.

• Stat cards summarise total captured events, blocked, redacted, and audited prompts.
• Charts break activity down by AI platform, by action taken, and over time.
• The table lists occurrence time, source client (endpoint and user), AI platform with its provider icon, model, upload file name, action, risk score, and details.
• Filters cover AI platform (multi-select), action, risk level, endpoint, classification, date range, and free-text search across prompt, user, and file name.
• Saved searches let each analyst keep their own recurring views.
• The prompt detail modal shows the endpoint, user, action, risk score, classification, matches, model, upload file name, and the full prompt text.
• Prompt content is returned only to administrators. Other roles receive the record with the prompt field nulled, and every view is written to the audit log.

From an incident record you can open a summary that explains the event in plain language: the matched classification, the legal reference behind it, the risk level, and the mitigation that was applied. The summary is generated from the record itself, so it always describes the same fields an auditor will read.

The legal reference is selected from the matched classification, so the report speaks the language of the regulation that applies.

AI telemetry is the most sensitive data a governance platform holds, because it contains the literal text employees typed into an AI tool. Moftgate treats it as evidence that must not leave your infrastructure.

• Inspection happens locally on the endpoint. Content is evaluated against your DLP rules on the device before the request leaves it.
• Incident records, prompt content, and telemetry stay in your own database. Nothing is sent to third-party analytics or model providers.
• Decryption can be bypassed per domain where inspection is not appropriate, so legal or personal traffic can be excluded.
• When an endpoint is offline, the agent keeps the last received policies and continues enforcing them locally.
• Offline events are stored on the device within the local retention budget and delivered gradually when the connection returns, so network capacity is not saturated.

• Inference on a self-hosted open model, running inside your own infrastructure so prompts and outputs never leave the perimeter.
• Grounded natural-language investigation, where every answer is linked to the underlying platform records rather than generated freely.
• Human-approved autonomous remediation: the assistant drafts a response pipeline, an administrator approves it, and the existing automation engine applies it on the endpoint.
• Extension of the ISO/IEC 42001 evidence pack to cover the platform's own AI-assisted actions.

When the model layer ships, it will follow the same sovereignty rule as the rest of the platform: inference inside your infrastructure, and every assisted action written to the audit log.