Compliance means being able to prove what the agent did.
When an auditor asks, you need to show which data the agent touched, what it sent out and who approved it. AvertGate produces that evidence on every call, automatically.
Decision flow
The call did not run
- Recipient is not on the allowed list
- Data stays in your network
- Decision written to the record
Writing a policy is not enough; you must show it was enforced.
Agents can read personal data and carry it into other systems. That needs a legal basis and a trail.
Keep data with you
Tool calls, file contents and SQL queries never leave the customer network.
Enforce the rule
On tools that carry data out, scanning and an allowed-recipient list apply before the call runs.
Keep the evidence
Every decision is chained with SHA-256; a later change is detectable.
See it. Limit it. Prove it.
Three questions an auditor will ask.
The record answers each question at the level of individual events.
- Who did what? Agent identity, session, tool and decision are written into every event.
- Did data leave? Outgoing arguments are scanned; a blocked call is marked separately.
- Who approved it? For calls that need human approval, the decision is recorded together with the Slack approval.
Audit trail
Every call in the live stream.
Take the rules out of code.
Allow, limit and approval rules per tool and argument live in a single YAML file. A change needs no redeploy.
- Deny by default. A tool that is not listed does not run.
- Argument limits. Fields such as amount, SQL and URL are bound to a rule.
- Human approval. Risky calls wait for approval in Slack.
Policy editor
The rule is written on one screen.
Every decision is recorded.
The decision, reason and rule id are linked with SHA-256; a record changed afterwards is detected.
- Reasoned decision. Every event carries the reason and rule id.
- Redacted arguments. Raw data never reaches the dashboard.
- Session trail. Calls in the same session are read together.
Session trails
Every session is traced end to end.
Audit trail
An auditor's question is one filter away.
Frequently asked
Does AvertGate make me KVKK or GDPR compliant?
Not on its own. Compliance is an organizational process. AvertGate provides the control and evidence for agent actions, and because data stays in your network the transfer risk is lower.
Does the audit record contain personal data?
Arguments are redacted in the events that reach the dashboard. Raw calls and results do not leave your network.
Can the record be altered later?
Events are linked by a SHA-256 chain. A retroactive change breaks the chain and is detected.
Guarantees
Four fixed principles behind every decision.
- 3 decisionsEvery call ends in allow, block or human approval.
- Fail-closedIf a check errors, the call is not run.
- SHA-256 chainEvents are chained, so any change after the fact is noticed.
- Your data stays with youTool calls and results never leave your network.
Put a gate in front of your agents.
Every deployment starts with a demo and a POC on your own agents.