Govern
every AI in
your tenant
Vörn is the firewall for AI workloads: the enforcement layer for the enterprise that switched AI on. Every host, every local model, every flagship cloud API under one sanctioned-use policy. Unapproved AI surfaces the moment it phones home, blocked, with the rule that fired and the reason why.
Both shapes of AI on a host
One policy governs the model you run and the model you call. Every workload is classified, every connection is attributed, and coverage reporting spans both.
Models you run
Self-hosted runtimes discovered and fenced automatically: workload-scoped rules mean your model server reaches exactly what its rules permit and nothing else.
APIs your teams call
Every application and agent calling hosted models is governed on your side of the connection: which providers are sanctioned, for which workloads, and what happens when something reaches for an endpoint you never approved.
Enablement without exposure
Saying yes to AI made your security team accountable for it. These are the four controls that make the yes defensible.
Sanctioned providers onlydefault deny · per-workload allowlists
Approve the AI your organization actually sanctions, per host and per workload. Everything else is denied by default, not discovered in next quarter's invoice or next year's breach report.
Shadow AI, surfacedattributed to the workload that tried
The unapproved endpoint a tool reaches for shows up in the feed the moment it phones home, attributed and explained. Run monitor mode first to see your real AI footprint before you enforce.
Data stays yoursguardrails module · blocked before egress
Secrets and PII in outbound prompts are blocked on the host, before they leave, with masked excerpts in the log. Redaction and per-rule actions where blocking is too blunt.
Evidence on demandaudit trail · event lake · csv export
When the auditor asks how AI usage is controlled, the answer is an export, not a slide: the policy as code, its full version history, and every verdict it produced.
Running in minutes
Deploy the agentsudo vorn install
One static Go binary installs as a native service: systemd, launchd, or a Windows Service. No kernel modules, no sidecar mesh, no build step. Egress steers through a local policy proxy that reads destinations without decrypting anything.
Write the sanctioned-AI policy as codepolicy.yaml · ordered · first-match-wins
An ordered rule list with a default verdict: the providers your organization approved, and nothing else. Match on host, glob, IP, CIDR, port, protocol, and workload. Hot-reloads on change; a document that fails validation changes nothing.
Watch it enforcedashboard on every host · console for the fleet
Denies block and alert in the same second: on the host dashboard, in your SIEM as syslog, CEF, or Splunk HEC, and in the fleet console. False positive? One deliberate click adds a least-privilege allow rule, versioned and reversible.
One agent, five instruments
The core firewall runs standalone. Add-on modules plug into the same event spine, isolated so a misbehaving module can never take enforcement down.
Firewall
Default-deny egress enforcement with real-time deny alerting, workload discovery, self-service unblock, and an embedded operator dashboard on every host.
COREGuardrails
Content inspection at the one point plaintext exists: prompt injection, jailbreaks, PII redaction, and secret egress blocked before it leaves the host. Inline or monitor-first.
ADD-ONAI SAST
Static analysis for AI applications mapped to the OWASP LLM Top 10: prompt-injection sinks, hardcoded keys, MCP and tool audits, agency limits. Same rules in CI and on the host.
ADD-ONTelemetry
Per-workload activity timelines, a data-flow map from files to model endpoints, usage metering, and a retention-bounded audit trail you can export.
ADD-ONBehavior
Explainable statistical baselines per workload. Drift, privilege-escalation patterns, and a decaying risk score whose every point cites the numbers that justify it. No black-box ML.
ADD-ONA fleet, not a folder of hosts
Agents enroll once and stay governed: signed policy push, staged auto-updates with automatic rollback, drift detection, an event lake, and a console built like the rest of the product.
Drift is visible
Every agent acks the policy version it applied. Applied ≠ desired is flagged on the fleet view the moment it happens.
Updates that roll back
Staged rollouts by deterministic hash. One failed health check pauses the release fleet-wide and the agent reverts.
Enforcement never blinks
Through updates, rollbacks, and re-keys, the agent holds your configured fail mode. Fail-open is not a config value.
Built for the audit
Signed pushed25519 · exact-bytes storage
Every command, enrollment bundle, and update offer is signed. Agents get the public key at enrollment and refuse anything unverifiable. Payloads are stored as the exact signed bytes.
Tenant isolation, twicecode filter + postgres row-level security
Every query filters on tenant, and every tenant table enforces FORCE ROW LEVEL SECURITY under a non-owner role. A query that loses its filter returns nothing foreign; a cross-tenant write fails. Another tenant's resources read as 404, never 403.
An audit trail that can't be skippedcsv export for evidence
Every operator mutation records actor, action, resource, and source IP in the same transaction. A mutation that cannot be audited does not happen.
Entitlements that holdenforced at ingest, not at install
Events from modules a tenant hasn't licensed are dropped at the door and reported back, even if a stale agent keeps the module running.
Per seat. Modules on top.
One subscription per operator seat carries the core firewall for the whole tenant: unlimited hosts and agents, no per-host meter. Switch capabilities on as add-on modules per tenant, billed on top of the seat.
Vörn Platform
- Sanctioned-provider egress policy on every host
- Shadow AI surfaced and blocked the moment it phones home
- Fleet management and signed policy push (ED25519)
- Staged auto-updates with automatic rollback
- Unlimited hosts and agents under the tenant, no per-host meter
- Audit evidence on demand, SSO, and priority support
AI Guardrails
Inline prompt and response inspection: prompt injection, jailbreaks, PII redaction, and secret egress blocked before it leaves the host.
ADD-ONAI Telemetry
Per-workload record of what each AI app and agent did: tool calls, MCP invocations, and data touched. Usage metering and an exportable audit trail.
ADD-ONAI Behavior Analytics
Per-workload baseline with drift detection, risk scoring, and escalation correlation. Every point cites the numbers that justify it.
ADD-ONSAST for AI
Static analysis for AI applications: prompt injection, hardcoded secrets, excessive agency, and insecure tool or MCP config. Same rules in CI and on the host.
ADD-ONseat pricing scales with committed seats and term · modules entitled per tenant · talk to us for a quote