Policy as code. Auditable as evidence.
Shield turns AI policy from a 40-page PDF nobody reads into Terraform-managed rules with hash-chained audit logs. Your CISO defines intent. Engineers commit it. Auditors verify it. Same artifact end-to-end.
Plug-in, change nothing
Works with Okta, Jamf, Intune, CrowdStrike, Zscaler — no rip-and-replace required.
Executive deepfake protection
Targeted voice/video detection for C-suite protection and training content validation.
Data residency options
US, EU, CA, AU residency choices to meet regional regulatory requirements.
AI governance is no less important than data.
Policy as code
YAML policies committed to Git. Every policy change has a diff, an author, a code reviewer, and a CI gate that previews the impact before it reaches production. No more "who changed that rule and when?" — your policy history is your compliance evidence. Policy packs for SOC 2, HIPAA, GDPR, and ISO 42001 ship out of the box and are updated as standards evolve.
Hash-chained audit log
Every policy decision — block, redact, allow, exception-granted — is written to an append-only, hash-chained log. Each entry includes the input fingerprint, the policy version that fired, the confidence score, and the outcome. Tamper-evident: any modification to the log breaks the hash chain and triggers an alert. Exportable in OCSF format to any SIEM.
Role-aware policy
Policies can vary by user role, device trust level, time of day, data classification, and geography. The same YAML policy file can say: "Allow GPT-4 for engineering on corp devices in EU business hours; block all for finance except Defog-hosted LLM; flag and log everything else." No separate policy engine required — it is all in one version-controlled file.
Acceptable-use enforcement
Per-provider allow/block. Per-data-class allow/block. Per-time-of-day, per-geography, per-device-trust. And you can compose any of them into a single policy rule. Enforcement happens at the edge, before data leaves the device — not at the network perimeter where it is already too late. The result: zero-trust AI governance without rewriting your network architecture.
Policy as Code — Committed, Promoted, and Audited
policy.toml
# .defog/policy.toml — committed to Git, promoted via CI
[providers]
allowed = ["openai.com", "anthropic.com", "azure-openai", "internal-llm"]
blocked = ["*"] # default-deny
[firewall.pii]
patterns = ["ssn_us", "pci", "phi_default", "corp_secret_internal"]
on_match = "block_and_redact"
escalate_to_classifier_on = ["corp_secret_internal"]
[firewall.source_code]
on_match = "warn" # softer for engineering, blocked for finance via group rule
[groups."finance"]
inherits = ["default"]
overrides = { "firewall.source_code.on_match" = "block" }
[siem.splunk]
hec_url = "https://splunk.corp/services/collector"
token_secret = "defog-prod/splunk-hec"
format = "ocsf"
defog-policy.yml
# .github/workflows/defog-policy.yml — gate every PR
name: defog-policy
on: [pull_request]
jobs:
govern:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: defog policy validate .defog/policy.toml
- run: defog policy diff --base main # fail if controls weaken
- run: defog policy promote --env staging --require-approval
Governance workflows
Change management
Policy changes flow through pull request. Two reviewers — one from security, one from the team the policy affects. Diff-on-deploy previews show exactly which users and which AI providers will be affected before the policy goes live. Rollback in one click restores the previous version. Every change, every approval, every rollback is logged immutably. This is the same GitOps workflow your infra team already runs for Kubernetes configs and Terraform.
Approvals & exceptions
Exception requests are submitted in-product by the end user. They specify the reason, the AI tool, the data class, and the duration needed. Security reviews and approves or denies — with a full audit trail on both sides. Exceptions are time-boxed: they auto-expire. No more email chains that say "can I just paste this one thing into ChatGPT?" followed by "ok fine but just this once" with no record that it happened.
Reporting & evidence
Pre-built reports for SOC 2 (CC6 and CC7 controls), HIPAA (§164.312 technical safeguards), GDPR (Article 30 processing records), EU AI Act (Article 12 logging requirements), and ISO 42001 (Annex A transparency controls). Export the full evidence pack for your auditor with one click. Reports include the policy version, the detection statistics, the exception log, and the hash-chain verification receipt.
- NIST AI RMF
- NIST AI Risk Management Framework (2023). Defog maps to all four core functions: Govern, Map, Measure, Manage. Pre-built evidence pack available.
- EU AI Act
- Article 12 (logging), Article 13 (transparency), Article 14 (human oversight) — all satisfied by Defog's audit log, detection explanation, and human-confirmation gate for consequential actions. High-risk AI use case documentation template included.
- ISO 42001
- AI management system standard (2023). Defog's governance layer maps to clauses 6 (planning), 8 (operation), 9 (performance evaluation), and 10 (improvement). In active audit — interim evidence available for procurement.
- SOC 2 (CC, A1, C1)
- Auto-evidence for AI-related controls
- HIPAA Security Rule
- Technical safeguards · audit log retention · BAA
- GDPR / UK GDPR
- DPIA template · DPA · purpose-limitation enforcement