Nothing leaves the building without a rule that allows it.
Edfast sits between your systems and the AI models. We decide which model gets to see which data. What is not permitted does not leave. Everything that happens lands in a log nobody can rewrite.
- “We don’t know whether this is legal.”
- “The document contains personal data. Where does it end up?”
- “The agent did something we never asked it to do.”
Three sentences we hear in almost every meeting. They are about the same thing. Nobody can show they have control.
This is what a refusal looks like
A caseworker pastes in a complaint with a name and a date of birth. This happens before anything leaves the building.
- refusedUS host · us-east (US)Jurisdiction US is not permitted for personal data
- permittedEU host · eu-north-finland (EU)110 gCO₂/kWh
- chosenNorwegian host · no-osl-hydro (NO)18 gCO₂/kWh. Lowest of the permitted routes
The rule runs in the router. You can run it yourself in the demo, with your own data classes.
Try it →What the receipt proves
A receipt is worthless if you don’t know how far it reaches. Here is the boundary.
A courier photographs every parcel and signs the photo. The photo shows the courier did not doctor their own log. It shows nothing about what the Dublin warehouse did with the parcel afterwards.
What it proves
- That the decision was made by us and nobody else. The signature is bound to our key.
- That the log has not been altered since. Not by us either.
- Which rule triggered the decision, and which providers were excluded.
- That you can check all of this yourself, without access to our systems.
What it does not prove
- That the provider ran the request where they say. We relay their attestation. We do not own their datacentre.
- That no copy was left behind on their side.
- That the model was not trained on the content. That follows from your contract with the provider.
| Route | What the receipt covers | Strength |
|---|---|---|
| Self-hosted on your metal | Both the decision and the execution. The machine is yours. | Complete |
| Norwegian host with an open model | Decision and execution. One hop. Named datacentre. | Strong |
| Large provider with an EU region | Our decision, plus the provider’s attestation about the region. | Chained |
| Hosted endpoint with no guarantee | Our decision only. Nothing about what happened next. | Weak |
An open Chinese model you run yourself sits at the top. The same model behind some hosted endpoint sits at the bottom. The model is identical. The control is not.
Ed25519 signature over a canonical serialisation of the receipt. Signatures are collected into a Merkle tree, so an entire period can be anchored in a single hash. No blockchain. The public key lives at /.well-known/edfast-trust-anchor.json. Verification runs in your browser, and we do not see what you check.
Verify a receipt →What did your agents do last month?
With twenty agents running, the question is no longer whether one request was lawful. It is whether anybody knows what they are doing.
Requests, from which teams, in which data classes.
What was refused, and which rule refused it.
What it cost per team, per agent, per month.
What the agents produced, and what passed through a human.
The cost figure is not a savings exercise. It is the simplest visible measure of something otherwise invisible. A system acting on its own.
We build emissions figures before they are required
AI consumption is reported today as an estimate of an estimate. No traceability to the individual run. CSRD and ESRS demand numbers, and the demands tighten.
Norwegian hydro runs at 10 to 25 gCO₂ per kWh. Virginia and Ireland run at 250 to 400. The router picks the greenest of the permitted routes. The number comes out low because the route was lawful, not the other way around.
This is not a requirement today. We think it becomes one, and build accordingly.
Why not just
- … use Copilot?
- It answers whether AI is in use. Not how. You cannot exclude a jurisdiction per data class, and you get no log to put in front of an auditor.
- … trust the provider’s EU region?
- You largely can. The contract says what is supposed to happen. It says nothing about what happened to request number 41,302.
- … run an open model yourself?
- Do it. That is the strongest route in the table above, and we are happy to route to it. Somebody still has to decide which requests may go there, and which may not go out at all.
Two things we do not promise
- StemmeNorwegian dialect support. Models that are good at English are weaker at Norwegian and weakest at dialect. The groundwork is openly published by the National Library, Språkbanken and NorwAI.
- NodeAn AI device that works without a network, for operators who cannot assume the cloud is available or permitted. No date.
Norway is unlikely to build its own frontier model, and does not need one. The country needs a layer that decides when foreign models may be used, shows what actually happened, and works when the cloud is not an option.
Get in touch →- Build our own foundation model. We build the layer above the models.
- Call the cryptography a blockchain. It is Ed25519 signatures and a Merkle log.
- Sell sovereignty as a slogan. It matters where regulation requires it.
- Promise proof we don’t have. See the table above. We say where the receipt stops applying.