Your company already runs on AI. Nobody's watching the door.
OhKube Swift sits in the request path between your applications and every model you use, inspecting, enforcing, pricing, and recording each call before it reaches the provider. One line of configuration. No SDK rewrite.
The problem, stated plainly
Your engineers are pasting source code into chat assistants. Your applications call six different models. Your agents make tool calls in production. And nobody in the building can answer three questions your board is about to ask.
What are we sending these companies?
Most tools answer this late.
What is it costing us?
Most tools answer this approximately.
Can we prove any of it?
Most tools do not answer this at all.
A dashboard tells you a credential leaked last Tuesday. A control point refuses the request.
That single distinction is the entire design. Swift is not a reporting layer bolted onto your AI usage. It is an OpenAI- and Anthropic-compatible gateway that your traffic flows through. Change one base_url and keep your existing SDK, your existing code, your existing models.
client = OpenAI(
api_key=OHKUBE_KEY,
base_url="https://swift.ohkube.com/v1",
)Observability tells you what happened. Swift decides what happens.
Three ways to catch the traffic
Deploy any or all of them. The gateway is the strongest control point, but the traffic you most need to see is usually the traffic nobody told you about.
AI Gateway
An OpenAI- and Anthropic-compatible reverse proxy. Point your SDK at it with one base_url and get enforcement, redaction, failover, and per-request cost attribution.
SDK middleware
Drop-in instrumentation that emits OpenTelemetry GenAI spans into the same ingest pipeline, so traffic you cannot route still lands in the same picture.
Endpoint & browser
A browser extension and lightweight endpoint agent that detect shadow AI — web apps, desktop apps, and local models like Ollama and LM Studio — and warn or block per policy.
What it does
Adopt it in one line. Enforce from the first request.
Point your SDK at Swift and you're done. No rewrite, no wrapper library, no per-application integration project. But unlike a passive proxy, this one has teeth: DLP violations return 400, blown budgets return 402, and policy denials never reach the provider at all.
It reads the whole request, not the easy parts
Every string in the request body is walked, not just the message content. A credential buried in a tool description, a tool_call argument, a nested tool result, or a metadata field gets caught. Most scanners check the obvious fields and quietly miss everything else, which is precisely where secrets hide.
Streaming responses are enforced, not merely observed
Virtually every production client streams. Scanning a response after it is delivered means no response-side protection at all. Swift's sliding-window guard holds output back, scans it, and redacts before release, never splitting a detection across a boundary and never releasing an unscanned byte.
An audit log that can prove it wasn't edited
Every administrative action commits the hash of the record before it. Append-only is enforced by the database itself, and the chain is verified by recomputation with a live integrity banner in the UI. Delete a record, reorder two, or forge one, and the check fails loudly.
Compliance evidence in one click
Fourteen controls mapped across the EU AI Act, NIST AI RMF, ISO/IEC 42001, and the OWASP LLM Top 10, generated from live platform data rather than a questionnaire filled in from memory. Each control is marked evidenced, partial, or not covered, with the reason.
A policy engine where the strictest rule always wins
Match on model, provider, endpoint, team, application, key scope, detector category, severity, or whether the request streams. The most restrictive matched effect wins regardless of rule order, so a policy added in month nine can never accidentally relax a block written in month one.
Budgets that actually stop the spend
Scope them to the organization, a team, an application, or a single key, enforced at the gateway with HTTP 402. Spend is summed from genuinely metered requests, and a scheduled checker catches a breach even when the offending team goes quiet.
Cost attributed to whoever spent it
Every request carries a team, application, environment, and virtual key. “What does AI cost us?” stops being one invoice per vendor and becomes a per-team, per-model, per-app answer with chargeback-grade attribution.
Least privilege, for people and for machines
Six roles — org admin, security analyst, compliance auditor, finance viewer, team lead, and member — enforced on every API route. Programmatic tokens carry permissions equal to the intersection of their scopes and their owner's current role, so a token can never exceed its owner and loses access the moment they change roles or leave.
Built so the evidence survives a bad day
Metering records are fsynced to disk before the response returns and drained in the background, so a database outage loses nothing. Recovery isn't assumed, it's rehearsed by a command that restores a backup and re-verifies the audit chain end to end.
Inside the console
Every detection with its detector, severity, action, and the exact field it came from. Previews are redacted; raw content is never stored.
Limits scoped to the org, a team, an app, or one key. Exceeded budgets refuse requests with HTTP 402 rather than sending an email.
Hash-chained and append-only, with a live verification banner. Any edit, deletion, or reordering breaks the check.
Match on model, provider, team, detector, severity, or streaming. The strictest matched effect wins regardless of rule order.
For the people who'll ask hard questions
A real control point, not a report. Sensitive data is stopped at the boundary, in both directions, including inside streamed responses.
Spend attributed to teams and applications, with hard limits that enforce rather than notify.
A tamper-evident record and framework-mapped evidence generated from live data, honest about its own limits.
One base_url. Keep your SDK. Nothing else changes.
Enterprise foundation
Multi-tenant isolation
Application-level scoping, regression-tested, with Postgres row-level security available as opt-in defence in depth.
SSO and SCIM
OIDC and SAML against Entra ID, Okta, or Google Workspace, with SCIM user and group provisioning.
Encryption and retention
BYOK encryption, field-level encryption for prompt content, and configurable retention windows.
Data residency
Residency controls with region-pinned storage for organizations that need it.
Deploy anywhere
SaaS, single-tenant VPC, or fully self-hosted via Helm chart.
Fits your stack
Slack, Teams, email, generic webhooks, SIEM export to Splunk and Sentinel, and Jira or ServiceNow for approvals.
The compliance pack names its own gaps deliberately. A pack that quietly omits what it cannot prove is a pack that fails the external audit it was built to pass. Generating one is itself an audited event.
Where Swift goes next
- Approval workflows for onboarding new models and tools
- Agent and MCP tool-call safety, plus OpenTelemetry GenAI traces
- Composite risk scoring per user, application, and vendor
- Reversible tokenization as an alternative to redaction
- Contextual PII detection via a named-entity model
- Semantic caching and load balancing across providers
You cannot govern what you cannot see, and you cannot prove what you did not record.
Swift puts a control point where your AI traffic already flows, so the answers to what left the building, what it cost, and what you can prove are the same answer, in the same place, available now rather than reconstructed later.