Roll out AI tools once, and run them on infrastructure you control.

For developer platform and IT teams who install, connect and operate the tools engineers use. Govern runs as one server binary with PostgreSQL.

For: Developer platform and IT
Server: One binary and PostgreSQL
Install: Docker Compose or Kubernetes with Helm
Managed policy: Windows, macOS and Linux
Deployment: Self-hosted, your cloud or air-gapped

What you own

What a platform team runs.

Rollout to every machineInstallers, settings and the address of your deployment on every developer machine, on three operating systems.

Joiners and leaversPeople arrive and leave through the identity provider, and every tool has to follow without manual accounts.

Model providersConnecting hosted and self-hosted models, keeping their keys, and giving each team the models it is allowed.

Applications and pipelinesServices and CI jobs that call models need credentials that never end up in a repository.

The service itselfDatabase, upgrades, backups and monitoring, sometimes on networks with no internet access.

What Neural Inverse gives you

Built to be operated by your team.

Each row is a capability of Neural Inverse Build or Govern in use today.

Managed policy for the appsGroup Policy templates on Windows, a configuration profile on macOS and a JSON policy file on Linux set the deployment address and audit settings. The CLI's managed settings file locks every key it sets.Build · Editor, Agents and CLI

Single sign-on and SCIMSAML 2.0 and OpenID Connect with presets for Microsoft Entra ID, Okta, Google Workspace and Ping Identity; SCIM 2.0 with identity provider groups mapped to roles. Machines without a browser sign in with a device code.Govern · Identity and access

One gateway for every providerAnthropic, OpenAI, Google, Azure OpenAI, Amazon Bedrock, Vertex AI and self-hosted servers behind OpenAI- and Anthropic-compatible endpoints, so existing SDKs work by changing the base URL.Govern · AI Gateway

Routing and reliabilityRetries with backoff, a circuit breaker per model, fallback chains and routing strategies. A fallback never reaches a model the caller could not use directly.Govern · AI Gateway

Keys for workloadsGateway keys scoped to the organisation, a team, a project or a person, with rotation and expiry. Keyless workload identity exchanges a Kubernetes or CI token for a key that lives at most an hour.Govern · AI Gateway

Policy on every machineThe endpoint agent fetches a fresh signed manifest every five minutes while online and installs each engine's compiled files where the tool reads them.Govern · Agent policy and approvals

Deploy your wayDocker Compose for one host, Kubernetes with Helm for production, or an offline bundle for networks with no internet access. Govern never runs as the PostgreSQL superuser. Hosted by us is also available.Govern · Deployment

How a change moves

How an agent action moves on a managed machine.

Install
Managed policy installs the apps and points them at your Govern deployment.
Sign
Govern compiles the policy for each engine and signs the manifest.
Enforce
The endpoint agent verifies the manifest and decides every action on the machine.
Approve
An ask with named approvers waits for one of them in the approvals inbox, never the requester.
Record
The decision, the rule behind it and the approval go to the hash-chained audit log.

For your auditor

What you can show an auditor.

Configuration changes are recorded the same way as everything else.

Every configuration changeChanges to roles, settings, policy, hooks and connections, written in the same transaction as the change. If the entry cannot be written, the change fails.

Sign-ins and provisioningEvery single sign-on attempt with its reason, and every SCIM change, with provisioning status that shows the last operations.

Model usageUsage events, per-key analytics, model usage and provider health.

Offline verificationA standalone verifier checks exported chains and archived segments with no network access and no connection to Govern, using the public keys of your installation.

Neural Inverse provides evidence toward the standards you report against. Certification stays with your organisation and assessor.

Still being built.

Listed so you can plan around it. None of it is part of what works today.

Device managementManaging developer devices from Govern, including configuration profiles and staged rollouts, is in progress.

LDAP and Active DirectoryDirectory sync is partial and is not a sign-in method. Use SAML or OIDC with SCIM.

Console pagesAccess guardrails, access reviews and agent instruction files are configured through the API; their console pages are not available yet.

Talk to our team.

Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.

Request access Contact us