AI compliance, handled
Every AI interaction in a regulated environment is an audit event. SupaProxy ensures all AI interactions are governed, logged, and compliant before your regulator asks.
Connects to everything your team already uses
The problem
Without governance, AI becomes a liability.
South African financial services regulations were written before AI. The obligations still apply.
Every query logged, every tool call recorded.
SupaProxy captures the full audit trail: who asked, what the AI did, which tools it called, how much it cost, and how long it took. Searchable, exportable, ready for examination.
Regulatory basis
Platform
Compliance built in. Not bolted on.
Every AI interaction flows through guardrails your compliance team controls. A plugin architecture means you extend without rebuilding.
Guardrails
PII redaction, scope enforcement, tipping-off prevention.
Compliance rules configured once, enforced everywhere. Every channel, every workspace, every query. Your organisation sets the floor; no team can go below it.
Audit trail
Examination-ready from the first query.
Who asked, what the AI did, which tools it called. Searchable, exportable, retention-compliant.
Plugin architecture
Bring your own providers, consumers, and guardrails.
Open-source plugin packages. Swap AI providers, add channels, or write custom compliance rules without touching the core.
Connections
Connect your systems safely.
Core banking, CRM, knowledge bases. Governed access with org-wide blocking for flagged connections.
Isolation
Sealed workspaces. Zero bleed.
Each team operates in full isolation. Data, tools, and conversations never cross workspace boundaries.
Model context protocol
Every department builds. You govern.
SupaProxy becomes the single governed gateway for every MCP in your organisation. Departments build freely. Your compliance team governs from one place.
Departments connect their MCPs. You set the rules.
Each team registers their MCP servers as connections in a workspace. Every connection goes through a review process before it goes live. Once governed, all tool calls flow through your org-wide compliance layer.
How it works
Trust & Security
Built for teams that take compliance seriously.
Every layer of SupaProxy is designed with security, auditability, and data governance in mind.
Data isolation
Every organisation is fully isolated. Workspace data, connections, and conversations never cross org boundaries.
PII redaction
Built-in guardrails detect and redact sensitive data before it reaches the LLM. Configurable per workspace.
Full audit trail
Every query, tool call, and AI response is logged with cost, tokens, and duration. Exportable and searchable.
Credential security
API keys are encrypted at rest and never exposed in logs or responses. Cookie-based auth with SameSite protection.
Role-based access
Admin, workspace admin, and user roles. Control who can configure workspaces, connections, and compliance rules.
Open source core
The server is open source. Self-host with full control, or use our managed cloud with zero infrastructure.