Shield FAQ

Shield is a governance and compliance layer for your AI infrastructure. It sits on top of your self-hosted AI stack (ODW.ai or other tools) and provides:

• Access control: Who can access what (SSO, roles, permissions)
• Audit logging: Who did what, when, and how — with tamper-proof records
• Compliance reporting: Pre-built mappings to SOC 2, ISO 27001, HIPAA, GDPR
• Data residency: Ensures data doesn't leave your defined boundaries
• Configuration hardening: Checks that your AI stack meets security baselines

Think of Shield as the "compliance officer" for your AI stack — it makes sure everything is governed, auditable, and defensible to regulators and enterprise customers.

Regulated businesses face a fundamental tension:

• Compliance pressure is enterprise-scale. Your customers, partners, and regulators demand SOC 2, HIPAA, or GDPR compliance — regardless of your company size.
• Budgets and headcount are not. You don't have a dedicated security team, GRC analysts, or the budget for enterprise tooling.
• Existing compliance tools are cloud SaaS. Products like Vanta, Drata, and Secureframe require sending telemetry to their cloud — which defeats the purpose of self-hosting for sovereignty.

Shield solves this by providing self-hosted governance that stays on your infrastructure. No cloud dependency. No telemetry leaving your servers. Full sovereignty.

Shield is designed for regulated SMBs (50–500 employees) in industries with compliance obligations:

• Healthcare: HIPAA compliance for AI systems handling patient data
• Financial services: SOC 2, GDPR for AI systems processing financial data
• Legal: Attorney-client privilege, data residency for AI systems handling case files
• Government contractors: FedRAMP, ITAR compliance for AI systems handling sensitive government data
• Education: FERPA compliance for AI systems handling student records

The typical buyer is a technical founder, CTO, or IT lead who needs to demonstrate compliance to win enterprise customers but can't afford a full security team.

Not exactly. Shield is a governance and compliance layer — it's more specific than a general security product.

What Shield does:

• Access control (who can access what)
• Audit logging (who did what, when)
• Compliance reporting (SOC 2, HIPAA, GDPR mappings)
• Data residency controls (where data can go)
• Configuration hardening (security baselines)

What Shield does not do:

• Network security (firewalls, WAFs)
• Endpoint security (antivirus, EDR)
• Vulnerability scanning (CVE detection, penetration testing)
• Encryption key management (HSM/KMS)
• Incident response automation

Shield governs what it can observe — access events, model invocations, data flows across your AI stack. It doesn't replace your firewall or antivirus.

The key difference is deployment model:

If you're self-hosting AI for sovereignty reasons, you can't send your infrastructure telemetry to a cloud compliance SaaS. That's the problem Shield solves.

No. Shield is model-agnostic and platform-agnostic. It works with:

• ODW.ai suite: Native integration with Desk, Voice, Vault, etc.
• Other self-hosted AI: llama.cpp, Ollama, vLLM, Text Generation Inference, etc.
• Vector databases: Qdrant, Weaviate, Milvus, Chroma, etc.
• Orchestration layers: LangChain, LlamaIndex, custom pipelines
• General infrastructure: Any system that can emit logs via syslog, webhook, or OTLP

Shield governs what it can observe. If your system emits access events, model invocations, or data flows, Shield can ingest and govern them.

"Governance" means control, visibility, and accountability over your AI stack:

• Control: Who can access what? Who can invoke which models? Who can read which data?
• Visibility: What's happening in real-time? Who accessed what, when? Are there anomalies?
• Accountability: Can you prove to an auditor that you're in compliance? Can you produce evidence on demand?

Without governance, self-hosted AI is a black box. You don't know who's using it, what data they're accessing, or whether you're compliant. Shield gives you the governance layer to make self-hosted AI defensible.

Maybe. If you're already compliant and have manual processes for:

• Access control (SSO, RBAC)
• Audit logging (immutable, tamper-proof)
• Compliance reporting (SOC 2, HIPAA, GDPR)
• Data residency controls

…then Shield might be redundant. But most SMBs don't have these processes — or they're manual, error-prone, and time-consuming.

Shield automates and centralizes these processes. Instead of spending days/weeks producing audit evidence, you can do it in minutes. Instead of manually checking configurations, Shield scans automatically and alerts on drift.

Even if you're already compliant, Shield can reduce the time and cost of maintaining compliance.

No. Shield is optional. You can use Desk, Voice, Vault, and other ODW.ai products without Shield.

However, Shield adds governance capabilities that are critical for regulated businesses:

• Without Shield: Basic access control (username/password), basic logging, no compliance reporting
• With Shield: SSO, RBAC/ABAC, immutable audit logs, compliance frameworks, data residency controls

If you're a regulated business, Shield is strongly recommended. If you're not regulated, you may not need it.

Shield provides enterprise-grade access control:

• SSO (Single Sign-On): Integrate with your identity provider (Okta, Azure AD/Entra ID, Google Workspace, OneLogin) via SAML 2.0 or OIDC
• RBAC (Role-Based Access Control): Pre-built roles (Admin, Editor, Viewer, Auditor) aligned to common organizational structures
• ABAC (Attribute-Based Access Control): Fine-grained policies based on attributes (department, clearance level, data classification)
• MFA (Multi-Factor Authentication): Enforce MFA for all users or specific roles (TOTP, WebAuthn/FIDO2)
• Service accounts: API key management with rotation policies
• Session management: Timeout enforcement, session revocation

All access control is centralized in Shield — no need to configure permissions separately for each ODW.ai product.

Shield supports SSO via SAML 2.0 and OIDC (OpenID Connect):

• Okta: Native integration
• Azure AD / Entra ID: Native integration
• Google Workspace: Native integration
• OneLogin: Native integration
• Other SAML/OIDC providers: Any compliant identity provider (e.g., Ping Identity, Keycloak, Auth0)

Setup typically takes 15-30 minutes. Shield provides step-by-step guides for each provider.

RBAC (Role-Based Access Control): Permissions are assigned to roles, and users are assigned to roles.

• Example: "Admins can delete data. Editors can edit data. Viewers can only read data."
• Simple, easy to understand, works for most use cases

ABAC (Attribute-Based Access Control): Permissions are based on attributes (user attributes, resource attributes, environment attributes).

• Example: "Users in the 'Cardiology' department can access cardiology patient records, but only if the data is classified as 'internal' and the request comes from within the hospital network."
• More flexible, more complex, needed for fine-grained policies

Shield supports both. Most customers start with RBAC and add ABAC as their policies become more complex.

Yes. Shield can enforce MFA (multi-factor authentication) at the organization level or per role:

• Organization-wide: All users must use MFA to log in
• Per role: Only Admins and Editors must use MFA; Viewers are exempt
• Per action: MFA required for sensitive actions (e.g., deleting data, changing policies)

Supported MFA methods:

• TOTP: Time-based one-time passwords (Google Authenticator, Authy, etc.)
• WebAuthn/FIDO2: Hardware security keys (YubiKey), biometrics (Touch ID, Windows Hello)

Shield provides centralized API key management:

• Create API keys: Generate keys for service accounts (e.g., automated scripts, integrations)
• Assign permissions: Each key has specific permissions (RBAC/ABAC)
• Rotation policies: Configure automatic key rotation (e.g., every 90 days)
• Revocation: Revoke keys instantly if compromised
• Audit trail: Every key usage is logged

API keys are scoped to specific actions and resources — no over-privileged keys.

Yes. Shield supports attribute-based policies that can restrict access based on:

• IP address: Only allow access from specific IP ranges (e.g., office network, VPN)
• Geographic location: Only allow access from specific countries or regions
• Network: Only allow access from specific networks (e.g., corporate LAN)

These policies are enforced at the gateway level — if a request doesn't match the policy, it's rejected before it reaches the application.

Shield provides instant access revocation:

1. Disable the user account in Shield (or in your identity provider if using SSO)
2. All active sessions are immediately terminated
3. All API keys associated with the user are revoked
4. The user can no longer access any ODW.ai products

If you're using SSO (Okta, Azure AD, etc.), disabling the user in your identity provider automatically revokes access in Shield — no separate step required.

Yes. Shield provides real-time visibility into all access events:

• Dashboard: Live view of who accessed what, when, and how
• Audit log: Immutable, tamper-proof record of every access event
• Search: Filter by user, action, resource, time range
• Export: Export logs in JSON or CSV for external analysis

Every access event includes:

• Who (user ID, IP address, device)
• What (action performed, resource accessed)
• When (timestamp)
• Outcome (allowed, denied, error)

Shield competes on sovereignty + AI-specific governance, not just general compliance. If you're self-hosting AI for data residency, you need a self-hosted governance layer — that's Shield.

Vanta and Drata are excellent compliance automation platforms, but they have different design priorities:

Choose Vanta/Drata if you need broad compliance automation (HR, IT, security, etc.) and don't have sovereignty requirements. Choose Shield if you're self-hosting AI and need sovereignty + AI-specific governance.

Configuration hardening means ensuring your AI stack meets security best practices:

• Security baselines: Pre-defined configurations for ODW.ai components (inference servers, vector databases, orchestration layers)
• Automated scanning: Shield scans your configurations against the baselines
• Drift detection: Alert when configurations deviate from the hardened state
• Remediation guidance: One-click fixes or step-by-step instructions

Why it matters: Misconfigurations are the #1 cause of security breaches. Shield ensures your AI stack is hardened against common vulnerabilities.

Shield enforces data residency policies to ensure data doesn't leave your defined boundaries:

• Data classification: Tag data as PII, PHI, financial, confidential, etc.
• Geographic residency: Ensure data processing stays within specific regions (e.g., EU-only for GDPR)
• Egress controls: Block or log data leaving defined boundaries
• Model routing: Ensure prompts containing classified data only route to approved models/endpoints

Example: A healthcare customer configures Shield to ensure PHI never leaves their on-premises infrastructure. If a user tries to send PHI to a cloud AI model, Shield blocks the request and alerts the admin.

Immutable audit logging means logs cannot be altered or deleted — they're tamper-proof:

• Hash chaining: Each log entry includes a cryptographic hash of the previous entry. If someone tampers with a log, the hash chain breaks.
• Append-only: Logs can only be added, never modified or deleted (until retention period expires).
• Integrity verification: Shield periodically verifies the hash chain to detect tampering.

Why it matters: Auditors need to trust that logs haven't been altered. Immutable logs provide that trust. If logs can be modified, they're not defensible in an audit.

Yes. Shield integrates with common SIEM and log aggregation tools via standard protocols:

• Splunk: Via HTTP Event Collector (HEC)
• Elastic (ELK): Via Elasticsearch API
• Grafana Loki: Via Loki push API
• Generic: Via syslog, webhook, or OTLP (OpenTelemetry Protocol)

Shield emits logs in standard formats (JSON, syslog) — no proprietary protocols. If your SIEM can ingest JSON or syslog, it can ingest Shield logs.

Yes. Shield supports multi-tenancy for Managed Service Providers (MSPs):

• Tenant isolation: Each customer (tenant) has isolated data, policies, and audit logs
• Consolidated view: MSPs can view all tenants from a single dashboard
• Per-tenant policies: Each tenant can have different compliance requirements (e.g., Tenant A needs HIPAA, Tenant B needs SOC 2)
• Delegated admin: MSPs can grant customers limited access to their own tenant (e.g., view audit logs, but not change policies)

This allows MSPs to manage compliance for multiple SMB clients from a single Shield deployment.

Yes. Shield is model-agnostic and platform-agnostic. It governs:

• Any AI model: llama.cpp, Ollama, vLLM, OpenAI, Anthropic, Google, etc.
• Any vector database: Qdrant, Weaviate, Milvus, Chroma, etc.
• Any orchestration layer: LangChain, LlamaIndex, custom pipelines
• Any infrastructure: Any system that can emit logs via syslog, webhook, or OTLP

Shield doesn't care what AI stack you're using — it governs what it can observe.

Shield logs all governance-relevant events:

• Access events: Who accessed what, when, and how (user, action, resource, timestamp, IP address)
• Policy decisions: Why a request was allowed or denied (policy evaluation details)
• Configuration changes: Who changed what policy, when, and why
• Model invocations: Who invoked which model, with what input, and what output (if configured)
• Data access: Who accessed what data (e.g., queried a vector database, read a document)
• System events: Logins, logouts, failed authentication attempts, session timeouts

All logs are immutable, tamper-proof, and retained according to your configured retention policy.

Retention is configurable and can be aligned to regulatory requirements:

• HIPAA: 6 years (default for healthcare customers)
• SOC 2: 1-7 years (typical for SOC 2 audits)
• GDPR: As long as necessary for the purpose (configurable per data type)
• Custom: Set your own retention period (e.g., 30 days, 1 year, forever)

Logs are automatically deleted after the retention period expires. You can also manually delete logs (e.g., if a customer requests deletion under GDPR).

Yes. Shield supports log export in standard formats:

• JSON: Machine-readable, easy to import into external tools
• CSV: Human-readable, easy to open in Excel or Google Sheets

You can export:

• All logs (full export)
• Filtered logs (by user, action, time range, etc.)
• Specific log entries (by ID)

Exports are generated on-demand and can be downloaded via the admin console or API.

Shield provides one-click evidence generation for SOC 2 audits:

1. Navigate to the "Compliance" section in the admin console
2. Select "SOC 2 Type II" (or Type I)
3. Click "Generate Evidence Package"
4. Shield automatically collects:
   • Relevant audit logs (access events, policy decisions, configuration changes)
   • Control mappings (which logs map to which SOC 2 controls)
   • Configuration snapshots (proof that your system is hardened)
   • Policy definitions (proof that you have policies in place)
5. Download the evidence package as a ZIP file (PDF + JSON + CSV)

What used to take days/weeks now takes minutes. The evidence package is auditor-ready — you can hand it directly to your auditor.

Yes. Shield provides a read-only auditor view:

• Auditor role: Create a user account with the "Auditor" role
• Read-only access: Auditors can view audit logs, control mappings, and evidence packages — but cannot change anything
• Time-limited: Auditor accounts can be set to expire after the audit is complete
• Audit trail: Every action the auditor takes is logged

This allows auditors to verify compliance directly in Shield — no need to export data and send it externally.

Shield logs are cryptographically tamper-evident:

• Hash chaining: Each log entry includes a hash of the previous entry. If someone tampers with a log, the hash chain breaks.
• Integrity verification: Shield periodically verifies the hash chain. If tampering is detected, Shield alerts the admin.
• Proof of integrity: You can generate a "log integrity report" that proves the hash chain is unbroken — hand this to the auditor.

If an auditor questions log integrity, show them the hash chain verification report. This is cryptographically provable — not just a claim.

Yes. Shield provides real-time alerting for suspicious activity:

• Policy violations: Alert when a user violates a policy (e.g., tries to access restricted data)
• Anomalous access patterns: Alert when access patterns deviate from the norm (e.g., a user accesses 10x more data than usual)
• Configuration drift: Alert when configurations deviate from the hardened state
• Failed authentication: Alert after multiple failed login attempts

Alerts can be sent via:

• Email
• Slack
• PagerDuty
• Webhook (integrate with any system)

Shield includes HIPAA-specific audit logging requirements:

• 6-year retention: Default retention policy for HIPAA customers
• PHI redaction: Automatically redact protected health information from logs
• Access logging: Log every access to PHI (who, what, when, why)
• Integrity verification: Tamper-evident logs (hash chaining)
• Export: Export logs in formats suitable for HIPAA audits

Shield's HIPAA control mapping shows you exactly which HIPAA requirements are met by Shield's audit logging. You can generate a "HIPAA audit readiness report" to show your compliance officer or auditor.

Yes. Shield is built with security best practices:

• Self-hosted: Runs on your infrastructure — no data leaves your servers
• Encryption: AES-256 at rest, TLS 1.3 in transit
• Access control: Shield itself is protected by RBAC/ABAC, MFA, SSO
• Audit logging: Every action in Shield is logged (meta-audit)
• Immutable logs: Hash-chained, tamper-evident
• Regular audits: Third-party security audits planned for v1.1

Shield is designed to be the most secure component in your AI stack — because it governs everything else.

No. Shield is self-hosted on your infrastructure. ODW.ai has zero access to your data, logs, or configurations.

Unlike cloud compliance SaaS (Vanta, Drata), Shield doesn't send telemetry to a third party. Everything stays on your servers.

This is critical for sovereignty-focused organizations. You can't claim data sovereignty if your compliance tool is sending your data to a cloud vendor.

Shield is designed to be resilient:

• Fail-open mode: If Shield is unreachable, your AI stack continues to operate (but without governance). You can configure fail-open or fail-closed.
• Local caching: Policy decisions are cached locally — if Shield is temporarily unreachable, cached decisions are used.
• High availability: Shield supports multi-replica deployment for high availability (99.9% uptime target).

In most cases, Shield going down does not affect your AI stack's availability — only its governance. Your users can still access the AI, but access control and audit logging are temporarily disabled.

Yes. Shield enforces encryption policies:

• At rest: AES-256 encryption for all data (audit logs, configurations, user data)
• In transit: TLS 1.3 for all network communication
• Key management: Shield integrates with your existing KMS (AWS KMS, Azure Key Vault, HashiCorp Vault) or uses its own encrypted keystore

Shield also enforces encryption policies across your AI stack — e.g., it can detect if your vector database is not encrypted at rest and alert you.

Shield provides data leak prevention (DLP) capabilities:

• Data classification: Tag data as PII, PHI, financial, confidential, etc.
• Egress controls: Block or log data leaving defined boundaries
• Model routing: Ensure prompts containing classified data only route to approved models (e.g., PHI only routes to on-premises models, not cloud APIs)
• Alerting: Alert when data leak attempts are detected

Example: A user tries to send a prompt containing PHI to OpenAI's API. Shield detects the PHI, blocks the request, and alerts the admin.

Shield is compatible with GDPR and provides tools to help you meet GDPR requirements:

• Data residency: Ensure data processing stays within the EU (or other defined regions)
• Right to access: Export user data on request (for subject access requests)
• Right to erasure: Delete user data on request (right to be forgotten)
• Consent management: Track and manage user consent (if applicable)
• Data processing records: Maintain records of processing activities (Article 30)

Shield's GDPR control mapping shows you exactly which GDPR articles are addressed by Shield. You can generate a "GDPR compliance report" for your DPO or regulator.

Shield follows industry best practices for security:

• Encryption: AES-256 at rest, TLS 1.3 in transit
• Access controls: RBAC/ABAC, MFA, SSO
• Audit logs: Tamper-evident, hash-chained
• Penetration testing: Regular third-party security audits (planned for v1.1)

We're pursuing SOC 2 Type II certification for Shield itself (expected late 2026). For now, we provide a security whitepaper and can answer specific security questions from your IT team.

Yes. Shield supports air-gapped deployment (no internet access):

• Offline installation: Install Shield without internet access (Docker images, offline packages)
• No external dependencies: Shield doesn't require internet access for updates, telemetry, or license validation
• Local updates: Updates are delivered via offline packages (e.g., USB drive, internal artifact repository)

Air-gapped deployment is common for government contractors, military, and high-security environments.

Shield includes pre-built control mappings for:

• SOC 2: Type I and Type II (Trust Services Criteria)
• ISO 27001:2022: Information security management
• HIPAA: Security Rule (healthcare)
• GDPR: Articles 30, 32, 33, 35 (EU data protection)

Additional frameworks (FedRAMP, PCI DSS, NIST) are planned for future releases. You can also create custom frameworks if needed.

Shield provides a control mapping that shows which SOC 2 Trust Services Criteria are addressed by Shield:

• Security (CC series): Access control, audit logging, configuration hardening
• Availability (A series): High availability, disaster recovery
• Confidentiality (C series): Data classification, encryption, egress controls
• Privacy (P series): Data residency, consent management, right to erasure

For each control, Shield shows:

• Met: Shield fully addresses this control
• Partially met: Shield addresses part of this control (you need additional tools/processes)
• Not met: Shield doesn't address this control (you need a different solution)

Target: 80% of SOC 2 controls addressed by Shield at MVP, 95% by month 18.

Shield helps you meet the controls required for SOC 2, but it doesn't guarantee audit passage (no tool can honestly claim this).

What Shield does:

• Provides the access control, audit logging, and compliance reporting required for SOC 2
• Generates auditor-ready evidence packages (one-click)
• Shows you which controls are met, partially met, or not met
• Provides remediation guidance for gaps

What you still need:

• Policies and procedures (Shield provides templates, but you need to customize them)
• Employee training (Shield doesn't train your employees)
• Other security tools (firewalls, antivirus, etc. — Shield doesn't replace these)
• An auditor (you still need to hire a CPA firm to perform the audit)

Yes. Shield provides HIPAA-specific features:

• PHI redaction: Automatically redact protected health information from logs
• Access logging: Log every access to PHI (who, what, when, why)
• 6-year retention: Default retention policy for HIPAA customers
• Business Associate Agreement (BAA): If using ODW.ai-hosted Shield, we'll sign a BAA
• HIPAA control mapping: Shows which HIPAA Security Rule requirements are addressed by Shield

Shield helps you meet the technical safeguards required by HIPAA (access control, audit controls, integrity, transmission security). You still need to address administrative and physical safeguards separately.

Yes. Shield provides GDPR-specific features:

• Data residency: Ensure data processing stays within the EU
• Right to access: Export user data on request
• Right to erasure: Delete user data on request
• Data processing records: Maintain records of processing activities (Article 30)
• Data protection impact assessments (DPIA): Templates and guidance for Article 35
• Breach notification: Alerting and logging for Article 33 (72-hour notification)

Shield helps you meet the technical and organizational measures required by GDPR (Article 32). You still need to address legal and procedural requirements separately.

Yes. Shield supports custom frameworks:

• Define controls: Create your own control definitions (e.g., "All API keys must be rotated every 90 days")
• Map to evidence: Map controls to specific audit logs, configurations, or policies
• Assess compliance: Shield automatically assesses whether each control is met
• Generate reports: Generate compliance reports for custom frameworks

This is useful for:

• Industry-specific frameworks (e.g., PCI DSS, NIST)
• Internal policies (e.g., "Company X Security Standards")
• Customer-specific requirements (e.g., "Enterprise Customer Y requires Z")

Shield provides a gap analysis feature:

1. Navigate to the "Compliance" section in the admin console
2. Select a framework (e.g., SOC 2, HIPAA)
3. Click "Run Gap Analysis"
4. Shield assesses each control and shows:
   • Met: Control is fully addressed
   • Partially met: Control is partially addressed (gap exists)
   • Not met: Control is not addressed (gap exists)
5. For each gap, Shield provides remediation guidance (what you need to do to close the gap)

This gives you a clear roadmap for achieving compliance — no more guessing what you're missing.

Yes. Shield can generate executive-level compliance reports:

• Compliance posture dashboard: Single view of readiness across frameworks (SOC 2: 85% met, HIPAA: 92% met, etc.)
• Trend reports: Show compliance improvement over time
• Risk reports: Highlight high-risk gaps and remediation status
• PDF export: Generate polished PDF reports for board meetings or investor due diligence

These reports are designed for non-technical audiences — they show the big picture without getting into the weeds.

Shield offers three deployment options:

1. SaaS (ODW.ai-hosted): We host everything. You just configure via the admin console. Fastest to get started (hours).
2. Private cloud: Deploy in your AWS/GCP/Azure VPC. We provide Helm charts and deployment guides. You manage the infrastructure.
3. On-premises: Deploy in your data center. Full sovereignty, even air-gapped. Requires DevOps support.

For most customers, SaaS is the fastest path. For regulated industries (healthcare, legal, government), we recommend private cloud or on-premises.

Setup time depends on your deployment:

• SaaS: 2-4 hours. Create an account, configure SSO, set up policies, and you're done.
• Private cloud: 1-2 days. Deploy the infrastructure, configure networking, test, and go live.
• On-premises: 2-5 days. More complex due to air-gapping, custom networking, etc.

Most customers are live within a week. Complex deployments (multi-tenant, custom integrations) may take 2-3 weeks.

For SaaS: Minimal. The admin console is designed for non-technical users (compliance officers, IT managers). You can configure policies, view audit logs, and generate reports without writing code.

For private cloud or on-premises: Yes. You need someone who can manage Docker/Kubernetes, configure networking, and monitor infrastructure. This is typically a DevOps engineer or IT consultant.

Day-to-day operation (reviewing logs, generating reports, adjusting policies) is non-technical for all deployment modes.

Shield is lightweight:

Shield runs as a set of Docker containers — no special hardware required. For high-availability deployments, we recommend Kubernetes with 3+ replicas.

Yes. Shield provides migration tools:

• Import policies: Import existing policies from CSV/JSON (e.g., from Vanta, Drata)
• Import audit logs: Import existing logs from your current system
• Parallel run: Run Shield alongside your existing tool for a transition period

Migration typically takes 1-2 weeks. We provide migration guides and support for common tools (Vanta, Drata, Secureframe).

Shield is configured via the admin console (web-based UI):

• Identity: Configure SSO, RBAC/ABAC, MFA
• Policies: Define access policies, data residency rules, compliance requirements
• Monitoring: Configure dashboards, alerts, SIEM integrations
• Audit: Configure retention policies, export settings
• Compliance: Select frameworks, run gap analysis, generate reports

No code required. All configuration is done through the UI. For advanced users, Shield also provides a CLI and API for automation.

Yes. Shield includes a preview mode:

• Sandbox: Test policies in a sandbox environment. No real enforcement — just see what would happen.
• Dry-run mode: Apply policies in dry-run mode — Shield logs what would be allowed/denied, but doesn't actually enforce.
• Gradual rollout: Enable policies for a subset of users first, then roll out to everyone.

We recommend testing thoroughly before going live. Most customers spend 1-2 days testing in dry-run mode.

For SaaS: Updates are automatic. We deploy new versions without downtime (rolling updates).

For private cloud or on-premises: Updates are performed via Docker/Kubernetes:

1. Pull the new Docker image
2. Restart the containers (rolling update for zero downtime)
3. Database migrations run automatically

Total update time: <5 minutes (plus downtime during restart for non-rolling updates).

Shield pricing is based on deployment mode and features:

Additional costs:

• Per user: $5/user/month after 50 users ( Starter includes 50 users)
• Additional frameworks: $99/month per additional framework (Starter includes 1)

Yes, significantly. Vanta and Drata typically cost $10K-$50K+/year. Shield costs $3,600-$12,000/year — 3-10x cheaper.

And Shield is self-hosted — you get full sovereignty. Vanta/Drata are cloud SaaS — you send them telemetry.

Of course, Shield is more focused (AI governance) while Vanta/Drata are broader (full compliance automation). But if you're self-hosting AI and need sovereignty, Shield is the only option.

No hidden costs. The total cost of ownership includes:

• Shield subscription: Monthly fee based on tier
• Per-user fees: $5/user/month after 50 users
• Additional frameworks: $99/month per additional framework (Starter tier)

That's it. No setup fees, no surprise charges. Infrastructure costs (if self-hosting) are separate — you pay for your own servers/cloud.

Yes. We offer a 14-day free trial of the Professional tier. No credit card required.

During the trial, you can:

• Set up Shield with your AI stack
• Configure SSO, RBAC, audit logging
• Run gap analysis for SOC 2, HIPAA, GDPR
• Generate evidence packages

At the end of the trial, you can subscribe or downgrade to the free tier (limited features).

We accept:

• Credit/debit cards: Visa, Mastercard, American Express (via Stripe)
• Bank transfer: For annual subscriptions or enterprise customers
• Cryptocurrency: Bitcoin, Ethereum, USDC (for privacy-conscious customers)

Invoicing is available for annual subscriptions. Contact us for details.

Yes. We offer a 30-day money-back guarantee. If you're not satisfied within the first 30 days, contact us for a full refund — no questions asked.

After 30 days, you can cancel anytime. You'll continue to have access until the end of your billing period, but no refund is provided for partial months.

Yes and no. Shield is available as a standalone product or as part of the ODW.ai suite bundle:

• Standalone: Purchase Shield by itself (for non-ODW.ai AI stacks)
• Suite bundle: Purchase the full ODW.ai suite (Desk, Voice, Vault, Shield, etc.) at a discounted price

The suite bundle includes Shield at a 20-30% discount compared to purchasing separately. Contact us for bundle pricing.

Shield scales horizontally:

• SaaS: Unlimited users (we handle scaling)
• Private cloud: Scales with your infrastructure. A single node can support ~1,000 users. Add more nodes for higher capacity.
• On-premises: Scales with your infrastructure. Typical deployments support 1,000-10,000 users.

For very large deployments (10,000+ users), we recommend Kubernetes with auto-scaling and a managed PostgreSQL database.

If Shield goes down, your AI stack continues to operate (in fail-open mode):

• Access control: Temporarily disabled (all access allowed) — or fail-closed if configured
• Audit logging: Temporarily disabled (events are queued and replayed when Shield comes back)
• Compliance reporting: Temporarily unavailable

For high-availability deployments, we recommend:

• SaaS: We provide 99.9% uptime SLA (Enterprise tier)
• Private cloud: Use multiple replicas across availability zones
• On-premises: Use failover clustering

Shield includes a monitoring dashboard:

• System health: CPU, memory, disk, network usage
• Policy decisions: Number of allow/deny decisions per second
• Log volume: Number of audit logs generated per second
• Latency: Policy evaluation latency (p50, p95)

You can also export metrics to external monitoring tools (Prometheus, Grafana, Datadog) via standard protocols.

Shield data is stored in PostgreSQL. Back up the database using standard PostgreSQL tools:

• Automated backups: Configure daily backups via pg_dump or WAL archiving
• Off-site storage: Store backups in a different location (e.g., S3, GCS, off-site server)
• Test restores: Periodically test restoring from backups to ensure they work

Shield provides backup guides and scripts for common deployment modes (Docker, Kubernetes, on-premises).

Yes. Shield can govern multiple AI stacks from a single deployment:

• Multiple ODW.ai deployments: Govern multiple Desk/Voice/Vault instances
• Mixed stacks: Govern ODW.ai + non-ODW.ai AI tools (e.g., llama.cpp, LangChain, custom pipelines)
• Multi-tenant: For MSPs, govern multiple customer AI stacks from a single Shield deployment

Each AI stack is configured as a "source" in Shield. Shield ingests logs from all sources and applies unified policies.

Shield is designed to be intuitive, but we provide training resources:

• Documentation: Comprehensive user guides for admins, compliance officers, and auditors
• Video tutorials: Step-by-step walkthroughs of key features
• Onboarding session: For paid customers, we offer a 1-hour onboarding session (remote)
• Support: Priority support for Professional and Enterprise customers

Most teams are productive within 2-4 hours of training. The admin console is particularly intuitive — no technical skills required for day-to-day operation.

Yes. Shield is highly configurable:

• Policies: Define custom access policies, data residency rules, compliance requirements
• Alerts: Configure alert thresholds, notification channels, escalation rules
• Reports: Customize report templates, add your company branding
• Integrations: Configure SIEM, webhook, and API integrations

For advanced customization, Shield provides a plugin system (Python) — write custom policy evaluators, log processors, or report generators.

Shield integrates natively with all ODW.ai products:

• Desk, Voice, Vault, etc.: Automatically emit access events, model invocations, and data flows to Shield
• Unified access control: Configure SSO, RBAC, MFA once in Shield — applies to all ODW.ai products
• Unified audit logging: All ODW.ai product activity is logged in Shield
• Unified compliance: Generate compliance reports covering all ODW.ai products

If you're using the ODW.ai suite, Shield integration is automatic — no separate configuration required.

Shield integrates with non-ODW.ai tools via standard protocols:

• OTLP (OpenTelemetry Protocol): For tools that support OpenTelemetry
• Syslog: For tools that emit syslog
• Webhook: For tools that can send HTTP POST requests
• API: Shield provides a REST API for programmatic log ingestion

If your AI tool can emit logs via one of these protocols, Shield can ingest and govern them.

Yes. Shield integrates with common SIEM tools:

• Splunk: Via HTTP Event Collector (HEC)
• Elastic (ELK): Via Elasticsearch API
• Grafana Loki: Via Loki push API
• Generic: Via syslog, webhook, or OTLP

Shield emits logs in standard formats (JSON, syslog) — no proprietary protocols. If your SIEM can ingest JSON or syslog, it can ingest Shield logs.

Yes. Shield supports SSO via SAML 2.0 and OIDC:

• Okta: Native integration
• Azure AD / Entra ID: Native integration
• Google Workspace: Native integration
• OneLogin: Native integration
• Other: Any SAML 2.0 or OIDC-compliant identity provider

Setup typically takes 15-30 minutes. Shield provides step-by-step guides for each provider.

Yes. Shield can create tickets in your ticketing system via webhooks:

• Jira: Create tickets for policy violations, configuration drift, or compliance gaps
• ServiceNow: Create incidents or change requests
• Generic: Any ticketing system with a webhook or API

This allows your team to track and resolve compliance issues in the same system they use for other work.

Yes. Shield supports multi-channel notifications:

• Email: Send alerts via SMTP
• Slack: Send alerts to Slack channels
• PagerDuty: Trigger PagerDuty incidents for critical alerts
• Webhook: Send alerts to any HTTP endpoint

You can configure different notification channels for different alert severities (e.g., email for low-severity, PagerDuty for critical).

Yes. Shield provides a REST API for programmatic access:

• Policy management: Create, read, update, delete policies via API
• Audit log queries: Query audit logs programmatically
• Compliance reports: Generate and download reports via API
• Log ingestion: Ingest logs from external systems via API

The API is fully documented (OpenAPI/Swagger) and supports authentication via API keys or OAuth 2.0.

Shield is powerful, but it has limitations in v1.0:

• No network security: Shield doesn't replace firewalls, WAFs, or network segmentation tools.
• No endpoint security: Shield doesn't monitor or protect individual endpoints (antivirus, EDR).
• No vulnerability scanning: Shield doesn't scan for CVEs or perform penetration testing.
• No full KMS: Shield enforces encryption policies but doesn't replace dedicated HSM/KMS solutions.
• No incident response automation: Shield detects and alerts on violations but doesn't automate full incident response playbooks.
• No application security testing: Shield doesn't perform SAST, DAST, or SCA.
• No cloud workload protection: Shield governs self-hosted infrastructure; cloud workload protection (CWPP/CSPM) is out of scope.

Planned for v1.1 (Q4 2026). We're adding pre-built control mappings for:

• FedRAMP: For government contractors
• PCI DSS: For businesses handling payment card data
• NIST CSF: NIST Cybersecurity Framework

In the meantime, you can create custom frameworks for these requirements using Shield's custom framework builder.

Planned for v1.2 (Q1 2027). Incident response automation will include:

• Automated playbooks: Define playbooks for common incidents (e.g., "If policy violation detected → create ticket → notify security team → block user")
• Integration with SOAR tools: Integrate with Security Orchestration, Automation, and Response (SOAR) platforms
• Automated remediation: One-click remediation for common configuration drift issues

This is a high-priority feature for enterprise customers.

Not in the current roadmap. Shield is focused on self-hosted AI governance. Cloud workload protection (CWPP/CSPM) is a different category with different requirements.

If you need cloud workload protection, we recommend using a dedicated tool (e.g., Wiz, Orca, Prisma Cloud). Shield can integrate with these tools via APIs and webhooks.

Key milestones:

• v1.0 (Q3 2026): MVP launch. Access control, audit logging, compliance frameworks (SOC 2, ISO 27001, HIPAA, GDPR), configuration hardening, data residency.
• v1.1 (Q4 2026): Additional frameworks (FedRAMP, PCI DSS, NIST), enhanced anomaly detection, MSP multi-tenancy.
• v1.2 (Q1 2027): Incident response automation, SOAR integration, advanced remediation.
• v2.0 (Q2 2027): AI-powered compliance (automated policy suggestions, predictive risk analysis), advanced reporting.

Roadmap is subject to change based on customer feedback. Contact us for the latest roadmap or to request features.

Shield is not the right fit if:

• You don't have compliance requirements: If you're not regulated and don't need to demonstrate compliance, Shield may be overkill. Use basic access control and logging instead.
• You need full security operations: Shield is governance, not a full SOC. If you need network security, endpoint security, vulnerability scanning, etc., use dedicated tools.
• You're 100% cloud-native: If you're using cloud AI (OpenAI, Anthropic) and don't self-host, Shield's sovereignty features are less relevant. (Though Shield can still govern cloud AI usage.)
• You need enterprise GRC: If you're a large enterprise (1,000+ employees) with complex GRC requirements, you may need a full GRC platform (ServiceNow GRC, Archer). Shield is designed for SMBs.

No. No tool can honestly guarantee audit passage. Shield helps you meet the controls required for compliance, but audit passage depends on many factors:

• Your policies and procedures (Shield provides templates, but you need to customize them)
• Your employee training and awareness
• Your other security tools (firewalls, antivirus, etc.)
• Your auditor's interpretation of the requirements

Shield reduces the time and cost of compliance by 50-80%, but it's not a magic button. You still need to do the work.

Three paths:

1. Free trial: Sign up for a 14-day free trial. No credit card required. Set up Shield with your AI stack and try it out.
2. Demo: Book a demo with our team. We'll walk you through Shield, answer your questions, and help you evaluate if it's right for your business.
3. Contact sales: For enterprise customers or custom deployments (on-premises, air-gapped), contact our sales team for a tailored quote.