Companies are deploying AI faster than they can govern it.
We spent years shipping production software and machine learning for organisations with regulated data and low-latency requirements. The pattern repeated everywhere. A team launches an assistant, a second team wires an agent into a core system, and the organisation discovers it has no single place to decide what data may reach a model, which provider may process it, where that processing happens, and how any of it is recorded.
Governance arrived after deployment, as a document nobody could enforce. We started obstruo to move that control into the request path, where a rule either executes or it does not. The question is no longer whether an organisation will use AI. It is whether it can prove how AI was used.
Six rules we hold ourselves to
They decide what we build, and just as often what we refuse to build.
We do not build models. We govern them, so you can change provider without changing your controls.
A rule that only lives in a document is not a control. Every policy in obstruo acts on the request itself.
If a decision is not recorded with the policy version that caused it, then for an auditor it did not happen.
When a check cannot run, fail closed is the default. Opening it up stays possible, and stays a deliberate decision.
EU-hosted, EU-operated, built for organisations that have to show where data was processed and under whose rules.
Named regulations, measured numbers, and honest capability labels, including for what we have not built yet.
A team with over 14 years of experience
Production software, applied AI, and building delivery teams inside strictly regulated environments.
Designs and ships enterprise-grade AI systems, with experience delivering in strictly regulated environments.
LinkedIn
Built high-scale, low-latency machine learning for marketing. Leads AI projects and the people who build them.
LinkedIn
Creator of AI and cybersecurity centres of excellence. Runs enterprise-grade delivery end to end.
LinkedInWho you are contracting with
Procurement and vendor-review teams tend to need these first. Registry identifiers are marked where they still need confirming before this page goes live.
Your AI. Your data. Your control.
Talk to a founder about your first governed project, or ask us the awkward vendor-review questions.