Is it FedRAMP authorized, or does it have an ATO?
Not today. It runs inside your environment and goes through your own approval process. Running in GovCloud does not carry an authorization over to the software. We help with the paperwork.
AI gateway for defense suppliers
If it isn't approved,it doesn't leave the gateway.
Every request is checked against your rules, sent only to models you approve, and written to a record you keep. On your servers or in your cloud.
Every request leaves a line like this.
One line for every request your team sends through the gateway. Kept on your side.
| Time | Credential1 | Model2 | Tokens | Cost | Result3 |
|---|---|---|---|---|---|
| 09:42:18 | proposal-writer | Llama on AWS GovCloud | 3,412 | $0.021 | Routed: ITAR marking |
| 09:41:55 | j.alvarez | GPT on Azure Government | 1,208 | $0.006 | Sent |
| 09:41:07 | shop-floor-bot | Llama on your server | 860 | $0.000 | Sent |
| 09:40:31 | intern-laptop | Public chatbot | 0 | $0.000 | Stopped: model not approved |
| 09:39:48 | eng-drafts | GPT on Azure Government | 2,044 | $0.009 | Sent, 2 emails masked |
| 09:39:02 | ops-bot | Mistral on your server | 0 | $0.000 | Stopped: over budget |
- 1
Its own credential
Your provider credentials never leave the vault.
- 2
Approved models only
Each credential reaches only the models you allow.
- 3
Checked first
Your rules route, mask or stop a request before it leaves.
- 4
Written down
Who, which model, what it cost. Refusals included.
Your apps change three settings: the address, the credential and the model name.
Your rules run before anything leaves.
Four steps, inside your environment, before anything reaches an outside model.
- 1 Tag
Read inside your environment.
Personal data, CUI and ITAR markings, your own keywords, and the labels on your knowledge bases. Markings are caught when they are written. Unmarked content is caught by your keywords and labels.
- 2 Decide
Your policy says allow, mask or block.
Your team sets it in a console. No code.
- 3 Route
Tagged data goes only where you approve.
Marked ITAR? It goes to your approved provider or backup only. No approved provider, no request.
- 4 Record
Every decision is written down.
Who sent it, the tag, the model, the time, the cost. Refusals included. If a policy cannot be checked, the request stops.
Set once, applied to every credential
- Approved models for each credential. Nothing else is reachable through the gateway.
- A block list on every credential. A prohibited model stays out.
- A spending cap and a rate limit for each credential.
- Per-document permissions. Searches return only what that person or app may see.
In final testing.
Can you see what your team sends to AI?
Most teams share one provider login, or let everyone sign up on their own. Then a credential leaks or a drawing lands in a prompt, and nobody can say who sent it.
Your customers ask where your data goes. Now you can answer.
It runs on your servers or in your cloud.
- Your server
- One package on your own Linux server.
- Your cloud
- AWS GovCloud or Azure Government, in your own account.
- Offline
- Tested with the internet cut off.
- Your sign-in
- Through your identity provider, smart cards included.
- Your models
- Any model you approve, on your servers or in your cloud.
- Nothing sent back
- Signed updates. Nothing is sent back to us.
Being packaged now.
What's ready, and what's next.
Ready today
- A credential for every person and app
- Provider credentials locked in the vault
- A spending cap per credential
- Rate limits
- Backups when a provider fails
- The request record
- Audit log
- Roles and sign-in
- Company documents searched by permission
Questions defense teams ask us first.
Will it get us through CMMC?
No software can. CMMC assesses your environment, not your tools. SPARKey Vault runs inside your environment and sits inside your scope like any other component.
Does our data still go to the big AI companies?
Only to the models your policy approves. Sensitive work can stay on your own servers or in your own cloud. Once your rules are set, anything tagged CUI or ITAR goes only to the providers you approve. With no approved provider, the request stops.
What is SPARKey Vault, in one line?
One door between your company and the AI providers. Your provider credentials stay inside it, and each person or app gets its own credential instead.
Why not just give everyone a provider login?
A shared login leaks sooner or later, and replacing it breaks every app that uses it. Separate sign-ups at each provider leave you with no single view of who sent what or what it cost.
Which AI models can we use?
Any model you approve. Models on your own servers, in AWS GovCloud or Azure Government, or from commercial providers where your policy allows. Each credential reaches only its approved list, and a block list keeps prohibited models out.
How long is the record kept?
The record stays inside your network, for as long as your policy says.
Can it search our company documents?
Yes. Each knowledge base has its own permissions, and every search is logged. Each document can be restricted further, in final testing now. Mirroring your Microsoft permissions document by document comes next, once we can see your setup.
What does it cost?
One product, the whole product. No tiers. Your AI providers still bill you directly at your own rates. License and support are set per customer, so we price it on a call.
Let's look at your setup together.
Thirty minutes, your questions, and a clear picture of where SPARKey Vault fits in your setup.
Book a briefing