AI UNDER YOUR CONTROL
BIFROST
The sovereign AI gateway.
You decide which models process your data.
Generative AI creates significant productivity gains. But for regulated businesses, there is a fundamental problem.
Many enterprise AI platforms automatically route data between different foundation models. This may be a model from Microsoft, OpenAI, Anthropic, Mistral, a vendor-built model, or an open-source model. Often, the choice is made automatically based on performance, price, or availability.
For ordinary businesses, this may be convenient. For regulated businesses, it may be a compliance risk.
Who has actually risk-assessed the model? Where is the data processed? What legal basis is used? Is there a third-country transfer? And can you document which model processed which data, under which policy, and for what purpose?
This is precisely the problem Bifrost solves.
The problem
The AI platform often decides more than you think. When employees or systems use AI, data may be passed on to models and vendors that the organisation has not risk-assessed. This creates three key challenges
Lack of control
Data may be processed by models that have not been approved for the specific data category or use case.
Lack of documentation
It may be difficult afterwards to document which model processed which data, and on what legal basis.
Lack of visibility into transfer and vendor risk
If data is sent to models or subprocessors outside the EU, risks may arise that have not been addressed in DPIAs, data processing agreements, transfer impact assessments, or vendor management.
For regulated organisations, it is not enough that the AI solution works. It must also be explainable, documented, and defensible in front of management, audit, the DPO, the risk function, and supervisory authorities.
The solution
One controlled gateway to all AI models
Bifrost is a model-agnostic AI gateway positioned between your organisation and the AI models you use.
This means that users and systems do not call models directly. All requests go through Bifrost, where your policies are automatically enforced.
Bifrost can control access to models from providers such as Microsoft, OpenAI, Anthropic, Mistral, and open-source models hosted in the EU.
You decide which models may be used for which data categories.
How Bifrost works
1. Data is classified
When a request is sent to AI, Bifrost assesses what type of data is involved.
This may include, for example:
2. Your policy is applied
Bifrost checks the request against your own rules.
For example, you can define that:
3. Data is protected before the model call
Bifrost screens every request, including attached files, before it reaches any model. Personal data, health data and content that breaches your own policies are flagged, and CPR numbers are always removed. Flagged content never reaches a frontier model.
This means that only the data permitted by your policy leaves your control boundary.
Nothing more.
4. The right model is selected
Bifrost routes the request to the model approved for the specific task, data category, and risk profile.
If the data is regulated or sensitive, it is processed only by EU-hosted or customer-controlled models, never by a frontier model.
If the task is non-critical, selected frontier models can be used where they create the most value.
5. Everything is documented
Each request is logged with the documentation below. In chat, the content itself is not stored, only this documentation and a fingerprint, plus any content that was flagged. In case work, the full case history is kept, so every decision can be explained afterwards.
6. Audit trail
Creates an audit trail that can be used for internal control, management reporting, DPO documentation, audit, and supervisory dialogue.
The audit trail is the foundation for Bifrost Audit, described below.
More than a gateway
Bifrost is also where the work is done.
Chat. Employees get the AI chat they know, with every request screened before it reaches a model. Word, Excel, PowerPoint and PDF files, including scanned pages, are read and screened the same way.
Knowledge base. Employees ask questions about your policies, guidelines and terms, and every answer points to the document, version and section it is based on. If the sources do not cover the question, Bifrost says so.
Case flows. A case moves from an open question to a structured flow. AI finds the facts in the case documents and shows where each fact comes from. Approved rules turn the facts into a recommendation, so Bifrost never guesses on terms. The case handler confirms the facts, decides and can overrule, and every step is logged.
Your own workflows. Conformance builds your processes into Bifrost as case flows, such as claims, transfers and other case work, integrated with your own systems so data is fetched and written back without retyping. Each flow is shown as a process diagram that you approve, and the flows built for you belong to you.
Bifrost Audit
Evidence that holds up in front of audit and the supervisor.
Bifrost Audit is a separate, read-only part of every Bifrost environment for your legal department and your second and third lines of defence. It shows how the system is built and proves that the controls work, without ever showing customer data or employee names.
Requirement by requirement. The front page maps the EU AI Act, GDPR and DORA article by article: what is required, what Bifrost does, and where the evidence is. Each requirement shows its status: documented, your responsibility, or missing.
Built from what actually runs. Flows, rules, data categories, models and suppliers are shown from the running environment, not from a drawing that goes out of date. Every view can be shown as the system looked on a chosen date, so the third line can see what applied when a specific case was decided.
Flows and AI Act classification. Every case flow is drawn from its definition, with its legal framework, rule versions, test results, the points where the case handler decides, and its AI Act classification with justification.
Data and models. What happens to each data category, the measured detection rates of the screening, proof that CPR numbers are always removed, and every model with provider, country, version and usage.
Controls. Test results for each release, proof that no request can reach a model without being screened, that the system fails closed, and verification of the sealed audit trail.
Samples without seeing the case. Each closed case appears as an anonymous record with a random audit reference, the versions used, the outcome, and whether the case handler departed from the recommendation. If the third line wants to see the case itself, the business retrieves it from its own systems using the reference.
Suppliers. Agreements, data processing agreements and terms for every supplier, structured for the DORA register of ICT third-party arrangements and including the exit strategy.
Evidence packs. Auditors can order an evidence pack for a period. Every view and every evidence pack is logged.
Designed for regulated European organisations
Bifrost is built for organisations where AI must be used in practice without losing control over data, models, documentation, and regulatory responsibility.
Bifrost runs on sovereign European infrastructure through our partnerships with T-Systems and Gefion. Your gateway, your policies and your logs remain under EU jurisdiction, independent of the legal instability surrounding transatlantic data transfers. Each customer runs its own complete Bifrost environment. No platform is shared between customers. For financial institutions and other regulated industries, this is not a preference. It is the difference between an AI strategy you can defend in front of your supervisor and one you cannot.
Why it matters
Bifrost does not replace legal assessments, DPIAs, data processing agreements, or vendor risk assessments.
But Bifrost makes it possible to operationalise them.
AI can no longer be treated as an experiment in the corner of the organisation.
In financial institutions, public sector organisations, and other regulated environments, AI must be governed as part of the overall governance, risk, and compliance framework.
Bifrost supports documentation and control in relation to, among other things:
For the CIO, DPO, and CRO
What Bifrost gives each of the three roles.
For the CIO
Bifrost provides one controlled AI access point across models and vendors.
You can take advantage of new models without having to change the entire architecture. When the model landscape changes, you change the policy, not the infrastructure.
For the DPO
Bifrost creates documentation of which personal data is processed, where it is sent, which controls are applied, and what basis the processing relies on.
This strengthens the work with GDPR, DPIAs, records of processing activities, data minimisation, and data processor management.
The legal basis for each data category is proposed by Conformance and approved by your DPO.
For the CRO
Bifrost makes AI risks visible and manageable.
You gain visibility into model usage, data categories, vendor dependencies, transfer risks, and control weaknesses. This makes it possible to report AI exposure to management, the risk committee, and the board.
Take Action Now
Book a walkthrough
We offer a one-hour walkthrough of Bifrost in the context of your own use cases. You leave with a clear picture of your current model-routing exposure and how to close it. Contact us to schedule.