Compliance-aware AI gateway

Your team is already using AI.
Now you can prove it’s safe.

Garita AI stands between your people and every model they reach for — inspecting what goes out, inspecting what comes back, and leaving an audit record your assessor will accept.

Request a demo See the request path

Checkpoint

RequestSummarise this discharge note for Ana Rivera, MRN 4471-8820, seen 12 Aug for post-op follow-up.

DetectedPHIHIPAANameMedical record no.

DecisionAllow · local only

Routed tollama-3.3-70b · on-premises (vLLM)

Auditsha256:9f2c…41ab · phi=2 · policy v34 · local_required

Illustrative — decisions shown are the real engine’s outputs38 ms

9Regulated data categories

7Model providers supported

2-wayRequest & response scanning

100%Requests audited

The exposure

Shadow AI isn’t a future risk. It’s this quarter’s.

Staff paste patient records, card numbers and contracts into public chatbots because it makes their work easier. Blocking the tools doesn’t stop it — it moves it onto personal devices where you can’t see it at all.

Data you can’t recall

Once regulated data reaches a third-party model it is outside your control — and outside your breach notification story.

Attacks aimed at the model

Prompt injection and jailbreaks turn a helpful assistant into a route around every control you built.

Nothing to show an auditor

Chat histories are not evidence. When the assessor asks what was sent and what was decided, screenshots will not do.

The request path

Three steps, no rewrite

Every request takes the same route in the same order. Classification happens before routing, so a decision is never made after the data has already left.

STEP 01

Point your apps at the gateway

Garita AI speaks the OpenAI API. In most cases it is a base-URL change — no rewrite, no SDK swap. Anthropic, Gemini, Cohere, Bedrock and self-hosted models all sit behind the same endpoint.

STEP 02

Switch on the regulations that apply

Choose an industry profile — healthcare, financial services, education — and it becomes your compliance floor. Teams and users can be stricter, never looser.

STEP 03

Prove it

Every request writes an append-only audit record. Feed it to your SIEM in real time, and hand an auditor a verifiable evidence packet whenever they ask.

Capabilities

Governance built into the request path

Not a dashboard bolted on afterwards — controls that run before the model sees anything, and again before the answer reaches your user.

Detection & enforcement

Policy-as-data guardrails

Regulations live as data, not code. Each maps a data category to an action and a routing rule, and the strictest match across every regulation in force always wins.

PII, PHI, cardholder, financial, government ID, credentials
Allow, flag, mask, redact, pseudonymise or block
Adding a regulation is a row, not a release

OWASP LLM01

Prompt injection defence

Weighted-signal detection for instruction override, system-prompt extraction and persona jailbreaks — tuned so your security team can discuss attacks without tripping it.

Instruction override and constraint nullification
System-prompt extraction attempts
Dampened for educational and defensive framing

OWASP LLM05

Response scanning

Most gateways inspect the prompt and stop there. Garita AI applies the same guardrails to what the model sends back, so regulated data cannot leave in the answer.

Identical detectors in both directions
Streamed replies scanned as they emit
Values split across chunks still caught

Data residency

Compliance-aware routing

A request carrying PHI can be pinned to a model running on your own hardware. If no compliant endpoint is available the request is refused, not downgraded.

Local-only routing for regulated categories
Fails closed — never silently falls back
Per-tenant and per-user model allow-lists

Audit ready

Evidence & SIEM

A continuous feed to your SIEM and point-in-time evidence packets for auditors, each with SHA-256 digests so a bundle can be verified months after it was produced.

Wazuh, Splunk, Sentinel, syslog, CEF or JSON
Findings tagged to OWASP LLM Top 10 and MITRE ATLAS
Packets ship the policy that was in force

FinOps

Cost & quota control

Every request is metered per tenant, user and model. Token and dollar budgets are enforced before dispatch, so spend is capped rather than discovered on an invoice.

Monthly token and USD caps
Spend broken out by team and model
Semantic caching to cut repeat spend

Separate engagement

Connected data — query your own databases

Staff can ask questions of the systems they already work in, under the same guardrails. This one is not a switch you flip: a DBA has to provision and scope a read-only login, permits have to be mapped to real roles, and in healthcare a BAA and a risk assessment come first. So it is quoted and delivered on its own, alongside whichever package you run.

How it works What it costs

Connected data

Let it answer from your own databases

Connect a read-only login and your staff can ask questions of the systems they already work in — billing, claims, inventory, case management — in plain language, under the same guardrails as everything else on this page.

Connect a read-only loginYou supply a SQL Server connection scoped to exactly what the gateway may see. Privileges are verified as read-only before the connection is usable, and the credentials live in the gateway — never in a prompt, never in the model's context.
The gateway catalogues the schemaIt profiles tables, columns and row counts once, and records what it could not measure as unknown rather than reporting it as empty. That catalogue — not your data — is what the model is told about.
You grant permits per userWhich connections, which tables, which data categories, and which columns come back masked. A user asks against their own permit, not the connection's full reach.
Generated SQL is validated before it runsThe model proposes a query; the gateway parses it and refuses anything that is not a read. A permit is checked against the table the query actually touches, so a table missing from the catalogue is denied rather than waved through.
Results come back masked and auditedMasked columns stay masked in the answer, and every reach into a connected database is written to the audit log — including the ones that were refused, which are usually the interesting ones.

What the model is given

bi.vw_ClaimsByPayer(payer_name, claim_count, paid_total)
bi.vw_AgingBuckets(bucket, invoice_count, balance)
bi.vw_ProviderVolume(provider_id, npi ·masked, encounters)
— 24 objects · 914,630 rows · 1 count UNKNOWN

A schema summary and nothing else. The model never receives your connection string, your rows, or a table the asking user has no permit for — so the worst a bad query can do is be refused.

What a user can reach

Tables their permit names, on connections their tenant owns
Columns in the data categories they are cleared for
Read queries the validator has parsed and accepted
A list of their own reachable tables, from the same gate

What no user can reach

Another tenant's connections, by any route
A table the catalogue has never seen
Unmasked values in a column their permit masks
Any statement that writes, alters or drops

Health data is separate and stricter: reaching a PHI store is a per-tenant opt-in, and those requests inherit the local-only routing rule — so the question, the schema and the answer stay on hardware you own.

How connected data is quoted

Frameworks

Mapped to what your assessors already use

Findings carry the control identifiers your security team searches on, so an AI incident lands in your SIEM already tagged — not as an unclassified alert someone has to triage from scratch.

OWASP LLM Top 10MITRE ATLAS HIPAAPCI-DSSGDPR CCPANIST CSF 2.0FERPA GLBAITAR / EAR

Garita AI supports your compliance programme with technical controls and evidence. It does not itself constitute certification or attestation.

See exactly what is covered

Questions

Before you ask

Does this replace our existing AI tools?

No — it sits in front of them. Your applications keep calling the same OpenAI-compatible API, and the gateway applies policy on the way through.

Do you store our prompts?

No. The audit trail records a SHA-256 hash of each request along with what was detected and decided, never the content. That is what makes an evidence packet safe to hand to an external auditor.

Can it answer questions from our own databases?

Yes. Connect a read-only login and the gateway catalogues the schema, then your staff can ask in plain language. Permissions are per user — which connections, which tables, which categories, which columns are masked — and the SQL the model generates is parsed and refused if it is not a read. Every access is audited, including refused ones.

Does the model see our data or our credentials?

Neither. It receives a schema summary — table and column names — and nothing else. The connection string stays in the gateway, rows are fetched by the gateway after the query passes validation, and masked columns are still masked in the answer.

Can it run entirely on our own infrastructure?

Yes. Garita AI deploys on your servers with your database, and can route regulated requests to models running on hardware you own.

What happens if a model provider goes down?

Requests fail over across a pool of endpoints. If no endpoint satisfies the compliance rules for the data in question, the request is refused rather than sent somewhere it should not go.

How long does a deployment take?

The gateway itself is a base-URL change in your applications. The work that takes time is deciding your policy — which regulations are in force, what each one should do, and who may reach which models. That is a conversation, and it is the part we help with.

Who can see the audit trail?

Administrators you designate, scoped to their own tenant. The record is append-only, so it cannot be edited after the fact by anyone — including us.

Who builds it

Made by the people who get audited alongside you

Garita AI is built by CyberNest Secure, a cybersecurity consulting firm in Puerto Rico. The practice is vCISO work, penetration testing, risk assessment and audit readiness for healthcare, government and other regulated organisations — which is where the product came from. We kept being asked the same question by clients who had already adopted AI, and could not answer it with a screenshot.

A garita is the sentry box on the San Juan fortifications — a stone post with a single narrow slit, positioned so one person can watch everything that passes without leaving the wall. That slit is the orange in our mark, and it is the product in one image: not a barrier, an aperture with someone behind it.

CISSPCISMCISA GIAC GCIHPenTest+ ISO 27001AZ-500

VendorCyberNest Secure LLC

Based inPuerto Rico

PracticevCISO · Penetration testing · Risk assessment · AI security

DepthHIPAA, NIST and ISO audit-readiness across healthcare and public sector

Morecybernestsec.com →

Request a demo

See it run against your own policies

Thirty minutes. We switch on the regulations that apply to you, send the kind of prompts your staff actually send, and show you the audit record that comes out the other side.

Reach us directly

Emailinfo@cybernestsec.com Phone+1 (939) 355-4445 CalendarBook 30 minutes → Vendorcybernestsec.com →

Mon–Fri, 9AM–6PM AST. Existing customers with an incident: use the 24/7 line in your runbook.