Command Center
Live KPIs from stored PostgreSQL data and event streams. Empty estates show empty. Copilot answers grounded SQL intents — it is not an unconstrained LLM.
Platform
Continuous AI assurance — from register to runtime.
OptimaTrust is sector-neutral software for discovering, assessing, testing, monitoring, and continuously assuring AI systems. It is not OptimaGRC and not a policy-only governance suite.
Estate and discovery
Unified AI register, type-filtered views, shadow-AI candidates, connectors, and a customer-side collector. Candidates are not assets until registered.
Assurance labs
Assessments against stored model or agent HTTP APIs. Security and red-team engines when installed. Findings, incidents, remediation, and re-assurance after change.
Runtime and governor
Trace ingest, watches, alerts, declared agent boundaries, and a Governor decide API. No invented traffic. No silent intercept of every third-party agent.
Evidence and overlays
SHA-256 evidence, eleven-dimension score, HMAC assurance certificates, ISO 42001 / NIST AI RMF / EU AI Act overlays. Not a GRC operating system.
Identity and tenancy
Multi-tenant isolation, RBAC, SSO (Entra ID and Google Workspace when configured), hash-chained audit logs, SaaS / private cloud / on-prem / hybrid.
The estate you actually run
Selected: AI agent. Every type is a row on one AI register — with owners, relationships, and a change log. Discovery candidates are not these until registered.
Explainable scoring
Dimension 1 / 11
Security
Prompt injection, jailbreaks, data exfiltration, and model/API attack findings.
Overall score is 100 minus listed deductions. If this dimension has no tests and no stored signals, it stays NOT_ASSESSED — never a silent 100.
Capability index
- AI registryA production AI estate register covering applications, agents, models, APIs, RAG systems, MCP servers, datasets, tools, and more.
- Discovery and shadow AIFind unsanctioned models, agents, and endpoints. Shadow AI stays a candidate until someone verifies it.
- Agent assuranceAgent cards, tool boundaries, loop limits, and an Agent Governor decision API — built for agentic systems, not chatbots only.
- Security and safety test labsRun security, safety, and evaluation packs against a stored model or agent HTTP API. Unavailable scanners stay unavailable.
- Runtime and tracesIngest user → agent → model → tool hops. Inspect traces. Watch for change, not a fake live intercept.
- AI trust graphInteractive knowledge graph of how applications, models, agents, tools, and data actually connect.
- AI bill of materialsVersioned AI BOM snapshots with CycloneDX and SPDX export from stored components.
- MCP, RAG, and privacy centersDedicated assurance centers for MCP catalogs, retrieval-augmented generation, and privacy profiles.
- Evidence and assurance scoreSHA-256 hashed evidence and an explainable 0–100 score across eleven dimensions. Empty dimensions stay NOT_ASSESSED.
- Framework intelligence overlaysISO 42001, NIST AI RMF, EU AI Act, OWASP LLM, MITRE ATLAS, and sector packs as overlays — not a GRC operating system.
- Hybrid assurance and collectorSaaS, private cloud, on-prem, and hybrid. A customer-side collector sends estate signals without giving away the model weights.
Trusted AI. Assured future.
See OptimaTrust test the systems you actually run.
Bring an agent API, a model endpoint, or a shadow-AI list. We will show registry, labs, score deductions, and evidence — not a GRC slide deck.