Prove your AI usage,every month, in Canada
The privacy officer, or the auditor, asks for the list of AI tools in use, what was sent to them and the rules that applied. Your teams’ tools call a model through the Agent Libre gateway, which records those three things in transit. Your compliance team pulls a report from it every month, with no request to IT.
Talk about your complianceThree questions with no written answer
An AI audit starts with three questions. In most organizations, the answer is in someone’s head.
Which AI tools are in use
Marketing subscribed to a writing tool in March, development to a coding assistant, support to a front-line agent. Each one calls a model at a different provider. The list kept by IT dates from the last annual review and only counts the tools bought through a purchase order.
Which data went out
An advisor pasted a customer’s file into a writing tool to prepare a letter. The name, address and account number went to a foreign provider whose terms sometimes allow it to keep the text to train its models. Nobody can say which day, or how many files followed the same path.
Which rules were in place
Internal policy forbids personal information in AI tools. The auditor asks for proof that the policy applies: the number of cases where a rule stopped something, and the date of each case. A policy document does not produce that proof.
You, your tool, and the model that answers it
Your tool stays the same. What changes is the model that answers it.
Your organization
Your teams, your data and your rules. You decide what the tool does, and with which data.
The tools your teams already use
The writing tool in marketing, the coding assistant in development, the agent that answers your customers: each one is put in place by the team that uses it, or by its vendor. All of them go through the Agent Libre gateway to get their answers.
The model that answers the tool
Every time the tool needs an answer, it calls a language model. That model can come from different providers. This is where Agent Libre comes in.
What Agent Libre changes behind your tools
Your AI tools remain those of your teams or your vendors. They change address to go through the Agent Libre gateway, which records and filters every call. The details of the controls are on the Governance page; this page describes what your compliance team does with them.
Every tool connected
Each call is recorded with the team, the tool that sends it, the model called and the volume. The gateway also records the calls you let go to a public provider; the inventory then covers everything you connected, not only the Agent Libre model.
Block, or mask and let through
For each category (personal information, card numbers, secrets, sensitive code), you choose the mode: the call is stopped, or the field is replaced with “[masked]” and the work continues. An alert can go to the security team for each case. Each application of a rule is dated in the log.
One report per requirement
For the chosen period, the report gives the status of each requirement: personal information, masking of secrets, data in Canada, log retention, access review by team, with the gaps to fix. It exports to CSV or PDF. Law 25, GDPR, PCI DSS or HIPAA depending on your sector: linking each line to the article of law remains your team’s work.
Data in Canada
The gateway is hosted and operated in Canada. With the Agent Libre model behind your tools, the data does not leave the country. Requests are not kept beyond processing and are never used to train a model.
Three tasks for the compliance team, month after month
The new tools
The inventory shows the tools that appeared since last month. The team assigns each one to a team and an owner, or has the access closed.
The report for the closed period
At the start of the month, the team exports the previous month’s report, compares it with the one before and files the export with the other audit records. When the auditor visits, twelve reports are ready.
The rules to review
The team reads the month’s blocked cases and masked fields. A rule that stops the same tool every day is settled with the team concerned; a rule that stopped nothing is checked. Adjustments are made from the console, without touching the tools.
What each team decides before connecting its tools
Four decisions to make before the first report.
Draw up the list of information that must not reach a model (name, address, date of birth, social insurance number, account number) and decide, for each one, whether the gateway stops the call or masks the field. That list becomes the written rule the auditor compares with the log, and it is the basis of the assessment required by Law 25.
Take stock of the tools that call a model today, team subscriptions included, and route them through the gateway one at a time, starting with those that touch customer files. A tool that does not go through it stays out of the report; the list of connected tools is also the list of what you can prove.
Set the date of the monthly export and the requirements the report must cover, before the first month. A report pulled on the same date, with the same requirements, compares from one month to the next; a report pulled on demand, the day before the audit, only proves that month.
Name who receives the alert when a rule stops a call, and the deadline for reading the log. A rule that blocks the same tool dozens of times a day points first to a misconfigured tool; a single case on a customer file calls for a follow-up the same day.
What we get asked on this topic
Does Agent Libre provide the AI tools the gateway watches?
No. The tools and agents are put in place by your teams or your vendors. Agent Libre provides the gateway that records and filters the calls, and the model that answers behind it, served in Canada for a fixed monthly amount.
Does the gateway see a tool that teams use without going through it?
No. It records what goes through it. A tool connected directly to its provider stays invisible, and routing it through the gateway falls to IT. The free 24-hour to one-week audit places the gateway in front of your current provider and gives a first inventory of what goes through.
What does the log contain, and for how long?
For each call: the team, the tool, the model, the time, the volume and the rules applied. Logs are kept for twelve months. The content of the requests is not kept beyond processing; the log proves that a call took place and that a rule applied, without keeping the text sent.
Does the report replace the assessment required by Law 25?
No. The report provides the evidence: calls, rules, blocked cases, period covered. The privacy impact assessment, and the link with each article of Law 25, GDPR or your sector’s rules, remain the work of your team or your legal counsel. Agent Libre does not write compliance opinions.
Can we keep a public provider behind the gateway?
Yes. The gateway records and filters calls to a public provider the same way as calls to the Agent Libre model; the report covers both. The difference shows on the “data in Canada” line: it flags the calls that leave the country.
See also
Financial services
Banks, insurers, credit unions and fintechs: what compliance, privacy and finance decide before putting Agent Libre’s model behind their AI tools.
Public sector and municipalities
What a ministry, a city, a hospital or a college decides before putting a model served in Canada behind its tools, and what the auditor finds there.
What “hosted in Canada” actually means
Servers, operator, applicable laws: what to check behind a promise of hosting in Canada.
Your company has two supply chains
The first one you already know. Materials come in, they are transported, stored, transformed, delivered. Every step has a supplier, a lead time, a unit cost. When the margin tightens, you walk down that chain step by step, and you generally know where to look.
The second one moves information instead of materials. A price request comes in and becomes a quote. An order comes in and becomes a production order, an invoice, a confirmed delivery. A site report becomes a change order, or it does not. This chain runs through every one of your departments and it employs a large share of your people.
The 24-hour to one-week audit
We measure your actual consumption at your current provider: who calls what, what it costs, and what is leaving your walls. Free, no commitment, and the report is yours even if you go no further.