AI Control Tower is an open-source, self-hosted platform for governing, auditing, and overseeing enterprise AI usage. It runs entirely inside an organization's own network — no external SaaS dependency, no data leaving the perimeter.
The problem it solves: employees quietly paste confidential data, source code, and customer information into ChatGPT, Claude, or local LLMs. Most companies have no visibility into this, no enforcement, and no audit trail. Existing governance tools are either closed-source, cloud-only, or require sending prompts to yet another vendor.
Core capabilities:
• Prompt Firewall — automatic PII masking (email, credit cards, SSN, phone, API keys) before prompts reach any provider. The provider never sees raw input.
• Shadow AI Monitor — passive network sniffer (DNS, TLS SNI, DHCP, ARP) plus a lightweight Go endpoint agent that detects locally-running AI tools (Ollama, vLLM, LM Studio) by scanning processes, ports, and model files. A Manifest V3 browser extension adds a third layer by flagging visits to AI services and warning users before they paste secrets into web interfaces.
• Governance — policy center with versioned JSON rules, approval workflows for risky requests, and a full audit trail of every AI request.
• MLOps — dataset management, compute detection, training (scikit-learn and Hugging Face), deployment, and monitoring. Includes a RAG service for question-answering over internal documents without fine-tuning.
• Incident Management — register, track, and resolve AI-related incidents with a complete audit history. Manual kill-switch to stop or roll back AI requests instantly.
Tech stack: FastAPI, Pydantic v2, SQLAlchemy 2 (async), PostgreSQL 16, Celery, Redis, Next.js 16, React 19, TypeScript, Go, Docker Compose.
Security model: Postgres and Redis bind to localhost only. Provider credentials are encrypted with Fernet. Agents authenticate with machine keys (X-Ingestion-Key), not user JWTs. Network discovery is read-only — no ARP spoofing, no anonymous auto-attach. The endpoint agent runs as an unprivileged user with a single optional CAP_NET_RAW capability for ARP/DHCP discovery.
License: Apache 2.0. Localization: English and Uzbek.
L-ka added AI Control Tower as alternative to Nightfall and GuardRails
