Connect your agents out-of-band. Dobby scans every run against the frameworks that apply and exports the evidence pack procurement and auditors accept.
Connect your agents and Dobby sees every run (what it did, which team ran it, and what it cost in tokens), then governs it against your policy and turns it into evidence you can prove. Activity in, evidence out.
Every organization writes data policy. Then AI runs on top of it, making decisions about what data is touched, where it goes and who reviewed it. Those are decisions humans can no longer trace or prove. A regulator, an auditor, or a procurement team asks for the evidence, and today you can't produce it.
Dobby watches your AI activity out-of-band, scans every run against the compliance modules each tenant has activated, and packages the result as audit-ready evidence, per framework, per module.
A credit-decisioning workflow runs. Dobby scans it against EU AI Act and DORA, finds the gaps, and produces the pack you would hand an auditor, the exact shape a bank's risk team asks for in vendor review.
Dobby reads your run telemetry. It never sits in the request path. Non-custodial by design: for regulated modules (Fintech AI Evidence) raw payloads are enforced into a customer-owned store, and that routing is available opt-in elsewhere.
Art 14 failed: a decision was finalised with no human reviewer recorded. You see it before the auditor does.
Control matrix, gap report, findings, and a SHA-256 manifest, the package a bank's risk team actually asks for.
Each tenant activates the compliance modules it needs. Out-of-band and framework-agnostic: the same engine, scoped to the frameworks you've turned on. Non-custodial by design: raw payloads can be routed to a customer-owned dataset (enforced for regulated modules, available opt-in elsewhere).
For AI vendors selling into banks and fintechs, and the risk teams on the other side of vendor review. Scans every run against EU AI Act, DORA, and SOC 2; exports the audit-ready evidence pack the reviewer asks for.
Organization-wide data-policy enforcement for regulated mid-market and enterprise, across every model, agent, and pipeline in the AI estate.
Clinical AI vendors and hospital compliance leads: verifiable patient-data policy across model and pipeline.
For AI vendors selling into government and agencies: evidence shaped to public-sector procurement and trust frameworks.
More modules in development. Marketplace and third-party developer SDK on the roadmap.
One control plane. Each module activates a slice of it. Everything below is shared platform infrastructure, framework-agnostic and out-of-band. Non-custodial by design: enforced for regulated modules, available opt-in elsewhere.
We treat security and data handling the way procurement reviewers ask us to. No false claims, no logos we haven't earned, just the posture we run today, and the certifications we're working toward.
Built for the AI vendors answering the AI evidence demands procurement and audits ask for today, and the bank, fintech, and enterprise reviewers on the other side.
Dobby holds metadata, findings, and signed evidence. For regulated modules (Fintech AI Evidence) raw payloads are enforced into a customer-owned dataset; elsewhere that routing is available opt-in. Until a workload is pointed at your own dataset, the scanner reads run payloads in Dobby's regional store. Always out-of-band: Dobby never sits in the request path.
Workspace data is pinned at creation to IL · EU · US. Region is permanent; cross-region writes never happen.
Lawful-basis docs, DSAR workflow, sub-processor list, 365-day audit retention. Enterprise DPA with SCCs available.
Platform is architected to SOC 2 controls: access, change tracking, immutable audit trail. Type II certification underway.
AES-256 at rest for all sensitive data, TLS in transit, SHA-256 hashing for keys. Per-tenant KEK derivation for provider credentials.
Four-state engine: compliant, violated, needs-review, unverifiable. We never paper over a gap as “compliant.”
Full posture, sub-processors, retention, and security contact: visit the Trust Center →
The procurement questions we get every week. If something is missing, write us. We'd rather have the conversation than dodge it.
pip install dobby-collector / npm install @dobbyai/collector), an out-of-band gateway, or a webhook from your existing observability stack. No new failure mode, no latency surface, no key custody.Start with Fintech AI Evidence: connect a workflow, scan it against EU AI Act + DORA + SOC 2, export the evidence pack. Start free, no credit card required.