Ask us the hard ones first.

No. Your inventories, glossaries, and attestations import as claims and stay where they are. OntaVera reconciles them against derived evidence and shows the gaps. You retire the old tool when it stops earning its keep, not before.

As managed SaaS, inference runs in your region and tenancy, and your metadata is never used to train anything. In your VPC and on premises, models run inside your boundary. In air-gapped mode, features that need hosted inference switch off, and everything else, including derivation, sealing, and evidence packs, runs in full, because trust states are computed, not generated.

Catalog, Governance, Lineage, Quality, Privacy, Regulatory, Data Products, and AI Governance, with Reference Data and Trust Intelligence arriving behind them. All ten work off one governed knowledge graph, so every number traces to its source and every control runs on the same record.

It is a live map of everything you have: systems, datasets, columns, business terms, rules, controls, owners, and reports, all connected and kept current. Every module reads and writes this one graph, which is why any answer can be traced back through it.

No. Your existing inventories, glossaries, and certifications import as claims and get checked against what the evidence supports, so the work your teams have already done carries forward. Over time one platform can replace several point tools, with one contract and one security review, but that is an outcome rather than a precondition.

No. Certification is computed from live evidence such as ownership, quality results, lineage coverage, and attestation currency. There is no manual override for anyone, including us. When the evidence lapses, the status drops on its own.

Yes. Run it as managed SaaS, inside your own VPC, or fully on premises, with air-gapped mode supported. It is the same product with full features on either side of your firewall.

You do. Bring your own keys, including a kill switch that you hold. Revoking the key cuts our access immediately and provably.

We are an early company and we say plainly what we hold and what we do not. SOC 2 Type II and ISO 27001 certification work is in progress, annual independent penetration tests are part of the program, and prefilled security questionnaires are returned within five business days. Ask us where things stand today and you will get a direct answer.

Never. Your metadata does not train our models, inference runs in your region and tenancy, and AI assistance can be switched off per domain if your policy requires it.

Yes. The AI Governance module inventories your models, agents, and prompts as governed assets, evaluates them before they serve, watches them in production, and gives your risk team a kill switch at three scopes: one run, one agent class, or a whole domain.

The first 90 days target five source systems and one priority report, with your first evidence pack built from your own lineage. More scope moves the date, and we tell you by how much before you sign.

The price follows the assets you govern, not seats. Business users are unlimited, connectors carry no per-connector fees, and each expansion sits behind an exit gate you approve. Exact numbers come from scoping, because they depend on the systems and reports in play.

Your graph, rules, policies, and evidence export in open formats, with 90 days of transition help. That is a contractual term rather than goodwill.

The BCBS 239 pack is the deepest today, with the 14 principles as testable controls, and a liquidity reporting pack leads with FR 2052a. Packs for CCAR, IFRS, GAAP, SOX, SR 11-7, GDPR, and the EU AI Act are arriving, and we will tell you plainly where each one stands. Load a pack, map it to your data, and posture starts computing.

Evidence packs generated in minutes from the sealed record: complete, reproducible, and reconstructable to any point in time. What was known, when it was known, and who decided, with proof it has not been altered since.