The control plane that stops AI agents breaking your rules
Companies are letting AI assistants issue refunds, open customer records and send data outside the business. It happens thousands of times a day, and the assistants decide on their own. IndexTracer sits in front of every one of those actions, stops the ones that break your rules, and keeps a record of all of it that nobody can quietly rewrite.
Working software today. One reply from a person, no newsletter.
Got it. Someone will reply personally within one working day, usually sooner.
That did not send. Please write to [email protected] and we will pick it up.
The gap
An AI assistant is neither an employee nor ordinary software. It decides in the moment, it holds the company's passwords, and by default it leaves nothing behind that anyone can review.
Teams build these in days. Nobody keeps a list, nobody rates how much damage each one could do, and the security review happens after something goes wrong.
The rules live in a document. Nothing actually stands between the assistant and the refund button, the customer record, or the message leaving the building.
The only record is a log that anyone in IT could edit. That is the first objection an auditor raises when you offer it as evidence.
How it works
Every time an assistant tries to do something real, the request goes through the checkpoint first. It looks up the rules for that specific assistant and makes one of four decisions, before anything happens.
The action goes ahead, and the decision is written down.
It never happens. The assistant is told no, and so is your record.
It pauses and waits for a named human to approve or decline.
Nothing is blocked yet. You just see what would have been.
This is not a report you read tomorrow about something that already happened. The action does not happen unless it is permitted.
Passwords stay at the checkpoint and are attached to approved requests only. The assistant never sees them, so a misbehaving one has nothing to leak.
For the first few weeks it blocks nothing and simply shows you what it would have stopped. You turn on enforcement when you are ready. Nothing breaks on day one.
Read the whole thing in plain words, including how it gets set up →
What you get
Every decision goes into the logbook, whether it was allowed, blocked, approved or declined. Each entry is mathematically linked to the one before it, and every day is sealed with a signature.
Alter or delete a past entry and the chain visibly breaks. Not even your own IT administrators can change history without it showing.
The system fills in your obligations automatically, showing which requirements you meet, which you do not, and the actual evidence behind each answer.
Issue temporary access that expires. Your auditor sees only the parts you choose, and everything they look at is recorded too.
Most compliance software watches and reports. This one steps in and stops things, and because it is the thing doing the stopping, its records are evidence rather than claims.
Coverage
Each requirement is checked against how the system really behaves, and marked met, partly met or not met, with the evidence attached. Not a checklist somebody ticked.
154 requirements in total. Start with the two most people need, SOC 2 and the EU AI Act, then turn on the rest when you need them.
Get started
IndexTracer is working software today, not a waitlist for an idea. Tell us where to reach you and we will get your agents registered, governed and producing evidence.
We send one confirmation and reply personally. No newsletter, no tracking pixels, and your address is never passed to anyone, which is the least you should expect from a company that sells data discipline. Or write straight to [email protected].
Got it. Someone will reply personally within one working day, usually sooner.
That did not send. Please write to [email protected] and we will pick it up.
11 frameworks. 154 requirements. Running in production today.