Open-source-based, customer-owned, compliant
More AI models and tools mean more choices, but also new challenges in data classification and control, rising costs and limited visibility.
Sigma Software's deployable platform helps you assess AI workloads, classify data, enforce company policies and route requests across eligible models and execution environments. With cost and usage visibility, observability and audit logs. Documented and compliant out of the box.
The problem
01
Sensitive data reaches AI tools with inconsistent classification, privacy and residency controls.
Sigma Software's platform deploys necessary documentation, information security controls and compliance policies. Data, security, compliance, residency and model-use policies are initially deployed, adjusted to your needs, and applied at runtime.
02
AI spending grows without matching model capability to the task or knowing where the budget goes.
With us you receive cost-aware routing, model selection and cost attribution. Prompt, context, routing decision, usage and audit logs are also there, out of the box.
03
Teams use public, sovereign and private AI with different rules for where requests can run.
With Sigma Software's platform you get access to all viable inference options: public cloud providers, frontiers, sovereign clouds and models, TEE and confidential compute with Partner AI and even optional Mac mesh cloud for your idle equipment double-use.
04
Bringing new routing layers carries new vendor dependency.
Sigma Software may run governance as a service, or deliver it to your environment as IaC, at a fixed cost and optional operational service packages. Unbeatable flexibility level.
What changes
For CISO, DPO and compliance
Confidential data reaches only the models and locations your policy approves. Each decision is recorded for audit.
For CFO and CIO
Each workload gets a model that meets its need, not the most expensive one. Spend is attributed to the team that caused it.
For CIO, Head of AI and platform team
Teams reach approved models through one governed entry point, not one integration per application. More workloads reach production under the same rules.
How it works
01
Identifies the task type and the model capability it needs, so routine tasks do not consume frontier-model capacity.
02
Runs deterministic rules over prompts and context and labels requests by confidentiality class, using configurations from your data governance policy.
03
Turns residency, retention, prompt logging and model-use rules into eligibility per provider and environment.
04
Sets budgets and attributes spend per team, application and use case.
05
Picks the lowest-cost target that meets capability and policy requirements, with fallback when a target is unavailable.
Inference choices
Use commercial frontier-model APIs when their capability is needed and company policies permit the provider and data class.
Run global and EU open-weight models in eligible cloud or sovereign environments, reducing dependency on any single provider.
Partner AI offers private inference in hardware TEEs using Intel TDX and NVIDIA H100/H200 confidential computing, with attestation evidence.
Use open-weight models on your own GPUs for workloads designated for on-premises execution.
Opted-in Apple Silicon Macs can serve local open-weight models for routine tasks such as ticket triage, summaries and extraction. The agent stops when the owner returns. Requests fall back when no Mac is free.
Own IaC, cloud AI service or a SaaS gateway?
Cloud AI services stay usable as routing targets. The difference is who runs the control layer and where policies get configured and enforced.
Cloud AI service or SaaS gateway
Open-source-based validated platform
Deployment options
We review your AI workload landscape, map it to sovereignty tiers and define a practical first scope.
You get:
For organizations that build AI capability in-house as a capital investment. Platform, policies and IaC run in your cloud, sovereign cloud or on-prem, with full handover.
You get:
For organizations that prefer managed service and advanced confidentiality. Sigma Software operates the governance platform – inference runs on Partner AI Cloud.
You get:
Deployment steps
Deploy the platform and baseline policies, onboard first teams, run an extended policy audit. Output is a running platform with a policy baseline.
Deep dive with transformation managers, infosec and compliance. Extend data routing rules, integrate core systems and onboard AI endpoints. Output is a routing matrix across all execution tiers.
If you prefer us to operate the platform, we deploy Operating Center service and ensure any further configuration and support is done within SLA and no headache for you. Otherwise, we expand adoption and hand over operational assets. Output is customer-owned routing and policy configurations, runbooks and a trained team.
In a non-binding call we review your AI workload landscape, map it to sovereignty tiers and define a practical first scope.
Open-source components and open-weight models where sovereignty requires them. The architecture moves across providers and environments without a rebuild.
Policy and routing configurations, IaC and deployment assets are handed over. Your team runs, changes and audits the platform without us.
Partner AI adds TEE-based inference and Idle AI Pool (Mac mesh) adds in-house compute, both under the same classification and cost policies.
Control mapping, DPIA templates, ISO/IEC 42001 gap mapping and EU AI Act role assessment, delivered by an ISO/IEC 27001 certified company.
A control layer between your AI applications and the models they call. It applies your security, residency and model-use policies and decides which model and environment may process each request. Requests marked sovereign stay under your jurisdiction; others can use approved external providers under their contract terms.
Yes. Sigma Software deploys the platform, built on open-source components, into your cloud, sovereign cloud or data center in DACH, the Nordics, the UK or the US. A running platform with baseline policies takes 1 week at a fixed price, and tailoring and integrations take about 1 month. For banks and insurers, AI providers are documented as ICT third parties, as BaFin’s December 2025 guidance on AI under DORA expects.
A self-built LiteLLM gateway gives you routing and budgets after 2–4 weeks of engineering, but classification rules, cross-provider policies, a confidential computing tier, compliance documents and operations remain open. A hyperscaler’s managed AI gateway governs requests inside its own cloud. The platform covers all of these in one delivery, runs in your environment, and you own the configuration.
It is open-source-based. The platform combines open-source components with open-weight models, so the routing layer and the models can run in your own environment. Policy and routing configurations, IaC and deployment assets are handed over as your assets. Track A also includes a product license, and the license terms define what it covers.
Not on its own. It supports specific obligations with logs, data governance evidence and documented provider eligibility. Risk management, human oversight and role-specific duties stay with your organization. The delivery includes an EU AI Act role assessment and obligations checklist. Annex III high-risk requirements apply from 2 December 2027.
Inference runs in hardware trusted execution environments based on Intel TDX and NVIDIA H100/H200 confidential computing. Prompts, model weights and outputs are isolated from the host operator. Remote attestation and per-request signatures let you verify the environment yourself, with trust resting on the hardware vendors’ attestation chain rather than on the cloud operator. Attestation evidence goes to the platform audit log.
Participation is opt-in. The agent is deployed through your MDM and has a kill switch. It runs only on locked Macs on a charger, stops when the owner returns and stores no data. It receives only routine workloads your policies allow.
Start with a non-binding scoping call and leave with a first scope and a recommended delivery track.
