VeilEngine™  ·  The evidence layer for regulated AI

Frontier AI on your
most regulated data —
verifiable by your auditor

VeilEngine lets regulated teams — healthcare, finance, legal, and their peers — run Claude, GPT, or Gemini on the data their compliance officers protect. Every request produces a signed receipt your auditor verifies offline, without a vendor in the loop.

Built for the frameworks that gate AI Provider-agnostic by design Auditor-verifiable offline

Running an operations-heavy business outside the regulated verticals? Start with AI Workflow Engines →

Receipt // rcpt_7e2af1c4
Signed
workflowdischarge_summary.draft
verticalhealthcare · HIPAA
providerClaude Opus
protection tierTier 1 · gateway
PHI in provider payload0 elements
round-trip integritypending
time-to-useful-answer18.3s
attestationsigned · offline-verifiable
sha256:a3f1c4d8b9e2f70a48cd...c194efb6e0d2a8f3
Illustrative · sample receipt
One doctrine, two ways to deploy it

AI systems that produce measurable work — under audit-grade controls

Vertical Edge AI works two ways for regulated mid-market teams: govern the AI that touches your most sensitive data, or move a blocked AI workflow into production. Both are built on the same evidence, approval gates, and auditor-checkable controls.

VeilEngine™ · Evidence Fabric

Run frontier AI on regulated data — provably

For teams under board or regulator pressure. Run Claude, GPT, or Gemini on PHI, MNPI, privileged, or claimant data — with signed receipts your auditor verifies offline.

Govern regulated AI
AI Workflow Engines

Automate a high-value workflow — governed

For operators with budget and workflow pain. Put document-heavy finance and operations work — invoice reconciliation, AP/AR, reporting — into production with approval gates and an audit trail.

Automate a workflow

Proof, not positioning: a live production deployment reconciling supplier invoices against 1,100+ active purchase orders at a mid-market distribution operator  ·  a sample evidence package you can verify offline  ·  an open verifier any auditor can run.

Architected for the frameworks that gate AI adoption
HIPAA SOC 2 Type II (2026) SEC Reg S-P NAIC AI Bulletin FERPA GDPR ISO 42001 NIST AI RMF EU AI Act
5
Regulated verticals supported — Healthcare, Finserv, Insurance, Legal, Education
12+
Compliance frameworks mapped to control evidence
3×
Frontier LLMs supported with zero re-engineering
0 raw
Sensitive data elements reach the provider boundary
The core problem

Your most valuable AI workflows touch your most regulated data — which is why they stall

Every regulated organization hits the same wall: the highest-value AI workflows touch the most sensitive data, and the compliance officer correctly refuses to send it to an LLM provider. VeilEngine resolves the conflict at the boundary — the data is protected before the request reaches the provider.

01  Execute

Frontier productivity, sensitive workflows

Data is secured before reaching the AI provider. Operators see a side-by-side preview of what the LLM will receive, with a semantic-preservation score, before any request leaves the boundary.

02  Attest

Cryptographic receipts, not narrated logs

Every request emits a signed receipt recording workflow, provider, and protection metadata. Receipts are hash-linked into a per-session chain; your auditor verifies each receipt signature offline with our open verifier. (Automated chain-walk verification and a cross-session transparency log are on the roadmap.) No trust in our platform required.

03  Port

Claude, GPT, Gemini — switch without losing evidence

Workflows are written against the VeilEngine execution layer, not the provider. Swap from Claude to GPT to Gemini for cost, capability, or geopolitical reasons — the evidence fabric and compliance posture follow the workflow.

The category gap

Reporting on AI is not the same as protecting it

AI-governance tools have converged on dashboards layered over an unprotected execution path. They record how AI is used; they do not change what data reaches the model. Vertical Edge AI starts at that boundary — sensitive data is protected before the request leaves your environment.

The category default

Dashboards over self-attestation

Logs reflect what the system says it did. Compliance officers narrate control posture. Audits depend on platform integrity.

Vertical Edge AI

Receipts over narration

Signed receipts at each boundary crossing. Your auditor runs the verifier offline — the evidence holds without trusting our platform.

AI Workflow Engines

A governed AI workflow, in production

Not every team starts with a compliance mandate — many start with a workflow that consumes hours of manual effort. Seven production engines compose into the document-heavy work mid-market finance and operations teams run every day: invoice reconciliation and three-way matching, AP/AR, multi-source reporting, vendor onboarding. The agents are the mechanism; the deliverable is governed output that holds up.

01  Compose

Seven engines, one platform

Document intake, approval routing, synthesis, reconciliation, drafting, and deadline tracking — composed into the workflow you actually run, not a generic bot.

02  Prove the ROI

Finance and operations first

The beachhead is document-heavy finance work — invoice processing, AP/AR, financial reporting — where the hours saved are measurable and the payback is fast.

03  Govern it

Approval gates and an audit trail, by default

Every workflow ships with human approval points, eval criteria, and a record of what ran. Where the data is sensitive, the same protection that powers VeilEngine applies — a human in the loop, not an ungoverned agent.

Solutions by industry

Built for the five industries where data sensitivity has gated AI adoption

We architect for the five regulated industries where data sensitivity has historically gated frontier-AI adoption. The gateway evidence layer is industry-neutral at launch; vertical evidence packs are compiled per engagement once a regulated workflow and framework scope are selected.

Outside these five?

The five are where compliance gates AI first — not the limit of who we serve

Both capabilities are independent of industry. The evidence layer maps to whichever frameworks govern your data — manufacturing, energy, government, and sovereignty workloads included — with the control mapping established during the discovery audit. The automation engines are industry-neutral by construction: our live reference deployment reconciles invoices against purchase orders for an operator in none of the five regulated verticals. The vertical pack is where the five become specific; the capability beneath it is not.

Map your framework
FAQ

Questions a CISO, CCO, General Counsel — or an operations leader — asks first

DLP and redaction tools alter prompts before they leave the boundary — but they leave no verifiable evidence the action happened, and they have no semantic-utility floor. VeilEngine adds two non-negotiables: cryptographic receipts recording the protection action at the boundary, and a Semantic Preservation Score so the operator sees how much usable signal survived. Redaction without evidence is unverifiable; evidence without preserved utility is unusable.
Our evidence fabric feeds upstream into your existing GRC. We don’t replace Drata or Vanta — we give them something to attest against. The cryptographic receipts and per-session evidence chain become first-party evidence of AI-specific control implementation, exportable in the formats your auditor and your governance platform already consume.
VeilEngine’s launch path is Tier 1 gateway protection: data enters the evidence boundary, is protected before provider egress, and produces signed receipts for offline verification. Tier 0 client-side protection and Tier 2 provider-under-agreement routing are engagement-scoped options, not default launch capabilities. EU AI Act, GDPR Schrems II, and sovereignty-cloud constraints map to tier choice, not to architectural rework.
Workflows are written against the VeilEngine execution layer, not against a provider SDK. Switching providers — for cost, capability, geopolitical posture, or contractual reasons — is a routing change, not an engineering project. Your evidence fabric, compliance posture, and protection boundary are preserved through the switch, and the receipt log records exactly which provider served each request.
Yes — that’s the design constraint. Auditors run our open verifier CLI against an exported session evidence package. The verifier checks each receipt signature and the evidence-package manifest, all offline. (Automated chain-walk verification is on the roadmap.) No call to our infrastructure required. If our platform vanished tomorrow, your evidence would still verify against the receipts you hold.
Pricing reflects several factors: the vertical pack, the number and complexity of workflows, expected receipt volume, the protection tier each workflow requires, and the breadth of framework mapping. Those variables differ enough between organizations that a published range tends to mislead more than inform, so we don’t quote one. We price against your specific exposure map in the discovery phase — never against a generic price list — and that discovery audit produces a deliverable you keep regardless of whether you proceed.
Our infrastructure is designed to SOC 2 Type II and HIPAA standards (encrypted at rest and in transit, regional residency controls). Type II attestation is on our 2026 roadmap. The deeper trust signal isn’t our certification posture — it’s that the protection boundary means an AI provider’s compliance posture inherits to your workflow, not the reverse. Detailed coverage on the Trust page.
Go deeper

Our analysis — and proof you can run yourself

Published analysis on the frameworks and failure modes that decide whether regulated AI reaches production — plus a working evidence package you can verify offline. The point of an evidence layer is that you should not have to take our word for it.

Before a conversation

Three questions you can answer right now — in your browser

Three free tools mirror the first hour of a discovery engagement — where your program stands, what the manual work costs, and which workflow to automate first. Each runs privately in your browser; nothing you enter leaves the page unless you choose to send it.

Where does your regulated-AI program stand?

A ~3-minute self-assessment across the four dimensions an auditor or board would ask about: usage, governance, evidence, and exposure.

Take the readiness assessment

What is the manual workflow costing you?

An annual figure for one back-office workflow — labor, rework, and modeled capacity release — from your inputs, with every formula published.

Run the ROI calculator

Which workflow should you automate first?

Seven questions apply the routing logic a discovery conversation uses — diagnostic first, or one governed workflow straight to production.

Run the fit finder

Engagements begin with a scoped workflow audit — production target within six weeks — or with the ~4-week AI Exposure Map, a diagnostic you keep either way.

Next step

The workflow you need to govern or automate

Describe a workflow your compliance officer has blocked, or one consuming significant manual hours. We respond with a preliminary plan — the framework gap and evidence path for governance, or the automation candidates and ROI for a workflow build.

Request a consultation See all tools  →