KWAYZER Governance
Coming 2026Prove what your systems did, to whoever asks.
Regulated teams, and anyone who has been asked to produce evidence about an automated decision and had nowhere to look.
What it does
An inventory of every AI use, generated from the codeNot a spreadsheet somebody maintains.
Every model call is routed through one place with a named task, and the EU AI Act inventory is generated from that routing rather than written alongside it. A new AI feature appears in the inventory because it exists, not because somebody remembered.
Consent and suppression as one conceptOne answer to 'may we contact this person', everywhere.
Consent and suppression live with the identity rather than with each channel, so a suppression recorded in one place is honoured in all of them — including by an automation that never asked.
An audit event for every mutationOne log, one writer.
Every change writes an event, and permissions have to exist in both the database grants and the permission catalogue — a guard fails the build when the two disagree, so a permission cannot be granted in one and forgotten in the other.
Just-in-time operator accessNobody holds standing access to your data.
An operator who needs to see unmasked data requests it with a stated purpose and a time limit measured in minutes, and the grant expires on its own. The request, the purpose and the expiry are recorded whether or not anything was looked at.
Data contracts and breach notificationWhat a dataset promises, and what happens when it stops.
A contract records what a dataset is expected to contain and how fresh it should be. Drift against the recorded shape is detected against what was actually observed rather than against a schema somebody typed.
Subject access and retentionAnswer the request without a manual trawl.
A subject's records can be located across the identity model rather than per table, which is what makes an access request answerable in a working day rather than a fortnight.
Blast radius before a changeWhat breaks if this field changes.
References to a field are traced across the recorded model, so the question 'what depends on this' is answered from evidence rather than from memory — and where a leg of that trace has no data, it says so rather than reporting a clean result.
Why this is hard to copy
Each of these names the mechanism that makes it true and where to check it. A claim without one is a sentence anybody could write.
The AI inventory cannot drift from the code.
Because it is generated from the router's task registry, and a test fails the build when a declared task is missing from the inventory or an inventory entry names a task that no longer exists.
tests/ai-inventory.test.ts
We cannot advertise a capability we have not built.
Because a list of phrases for unbuilt capabilities is scanned across the files that render to a customer, and each entry names what would discharge it. The list was created after three sign-on claims shipped against a product that had none.
src/lib/compliance/capability-claims.ts
An operator's access to your data expires on its own.
Because a grant carries a hard maximum enforced by a database constraint rather than by application code, so a longer one cannot be written even by a bug.
src/lib/compliance/operator-access.ts
Pricing
Not available yet. Join the waitlist and we will come back to you before it opens, not after.
This is a real list that a person reads — not a form that collects an address and does nothing with it.
The rest of KWAYZER
Five products on one identity, one permission model and one audit log. You can buy one and add another without a migration.