◇ AI meets your data — safely ◇

AI uses your data.Conarium watches its every move.

Conarium is the governance layer between enterprise AI and sensitive data. We enforce policy, mask data, and record every action — in real time.

Attack the live demo →Deploy locally

Break it if you can — every attempt lands in the audit log.

Conarium governance eye — incoming systems flow through the eye and exit as governed outputs
Incoming systems
Governed outputs
AI Agent
Analytics Tool
App / Service
Data Pipeline
Third-party AI
BI Dashboard
Masked Data
Filtered Rows
Allowed Fields
Safe Context
Policy Applied
Audit Recorded
Governance · Active
◑ PII Masking✓
⊘ Deny by Default✓
≣ Row & Field Controls✓
⌖ Tamper-evident Audit Logs✓
◈ Policy Enforcement✓
View live policy status →
0
0
0
⌂
Self-hostedRaw values stay in your perimeter
⊘
Zero vendor egressNothing is sent to us
⌖
KVKK / GDPR audit trailAudit without raw PII
Works with your stack ·PostgreSQLDocs & MarkdownOpenAPISlackJiraClaudeCodexCursorCopilot
In plain English
Think of it as a checkpoint at your door.

An AI coding tool is like a brilliant new consultant you turn loose in your filing room. It works incredibly fast — but it reads everything, including what no outsider should ever see: customer names, passwords, card numbers. Conarium is the checkpoint at the door: before the consultant sees a single file, it blacks out every secret, notes down everything that was looked at, and makes sure not one original ever leaves the building.

You decide what's allowed. You keep the key.

And the clever part — the company that makes Conarium never sees your files either. It runs inside your own walls, so there's nothing for anyone to leak.

See what your AI sees
Watch your own data leak — then stop it.

Pick a sample or paste your own. See exactly what an AI assistant reads the moment you point it at real data — then flip Conarium on. Everything runs in your browser; nothing is ever uploaded.

This is a pattern-based preview. See what production masking does — and doesn't — catch →

The problem
AI sees everything.
So does the risk.

Point Cursor or Copilot at a production database and it drinks the raw stream — national IDs, IBANs, balances, live keys. One prompt can expose your most sensitive tables. Security teams simply can't allow that.

⚠ ungoverned
USER PROMPT
Show me recent account holders
AI — WITHOUT GOVERNANCE
1Ayşe DemirTR00 0000 0000 0000 0000 000112345678901+90 5xx xxx 00 01₺482,900
2Mehmet YılmazTR00 0000 0000 0000 0000 000212345678902+90 5xx xxx 00 02₺1,204,350
3Zeynep KayaTR00 0000 0000 0000 0000 000312345678903+90 5xx xxx 00 03₺76,120
RESULT: MASSIVE BREACH WAITING TO HAPPEN.
How it works
One eye between the model and your data.
AI Assistants
Claude
Codex
Cursor
Copilot
→
⊙
Conarium
MCP Governed Gateway
→
Your Sources
Postgres
Docs & ADRs
OpenAPI
Jira · Slack
Live demo
Watch it govern in real time.

No narration — the real pipeline. A request arrives, the eye decides, and the audit writes itself.

Live
1 PII Masking
2 Row Caps 100
3 Policy Deny
AI · Request
Data returned
Audit trail · live
✓ PII masked before AI sees it✓ Row caps enforced✓ Policy guardrails active✓ Tamper-evident audit logged
Interactive Demo
Three attacks. All three stop at the door.

Three queries a hostile assistant would actually send. Press one and watch what the gateway returns — and what lands in the audit log. Want to type your own? The box in the live demo above is open.

ATTACK VECTORS

AI TERMINAL
> Waiting for query execution...
Nice try. Nothing leaked 🛡️ AUDIT LOGGED
Try it yourself
Don't take our word for it. Point your own AI at it.

This is a live Conarium server with a governed sample database. Connect it to your own Claude in about 30 seconds and try to get the protected data out — the masked columns, the denied tables. You won't. What the policy allows, you will see, twenty-five rows per query: that is what allowing a table means.

CONNECTOR URL
https://demo.conarium.dev/t/conarium-public-demo-tryit-2026/mcp
STEP 1

In Claude, open Settings → Connectors → Add custom connector.

STEP 2

Paste the URL above, name it anything, and connect.

STEP 3

Ask it for the revenue. Then ask it for the customer list.

WHAT YOU'LL SEE
Revenue → answered

Business figures come back instantly. Governance isn't a wall; the work still gets done.

Names → [MASKED_PII]

Sales rows arrive complete, but every name, phone and email is redacted before the model reads it.

Customer table → denied

Not permitted by policy. The AI can ask; it simply never gets an answer.

Sample data is entirely synthetic — no real company, no real people. The connector is read-only and rate-limited. This is the same code you can read on GitHub and run on your own server.

Key features
Built for security. Designed for engineers.
◑

PII Masking

Emails, IDs, cards and secrets redacted in the response stream — before the model sees a character.

⊘

Allow / Deny

Whitelist what AI can access. Your secrets table stays invisible; unauthorized access throws PolicyError.

≣

Row Caps

Hard per-query limits. No silent exfiltration of millions of rows. You stay in control.

⌖

Tamper-evident Audit

Every access logged — who, what, when, rows, decision — in a hash-chained, tamper-evident ledger. Alter one entry and the chain shatters. Built for KVKK / GDPR evidence, no raw PII.

✓

Verifiable Receipts

Every governed access can emit a portable receipt — Ed25519-signed, carrying the fields EU AI Act Article 12 / 19 asks for, with chain heads anchored to OpenTimestamps. An auditor checks it offline using conarium-verify: no Conarium install, no call back to us. It proves records were not altered, deleted, reordered or backdated after they were created — it does not claim they were correct when written.

⊗

Read-Only Write-Guard

DELETE, DROP, UPDATE, INSERT — blocked at the door. Even smuggled inside comments or stacked queries. The assistant can read; it can never wreck.

❖

Beyond-the-Column Masking

PII slipped past as base64 or hidden behind an alias (email AS contact)? Still caught. Masking follows the data, not just the column name.

⬡

Every Source, One Layer

Postgres, internal docs, OpenAPI specs, Jira and Slack — a single governed layer over all your scattered knowledge, spoken in MCP to every assistant.

⌂

Self-Hosted

Runs entirely on your infrastructure. Raw values stay in your perimeter — only policy-approved disclosure leaves. Not ours. Yours.

The one outbound call — a startup version check — is documented and switches off with one variable.

∞

Tool-Agnostic

Claude, Codex, Cursor, Copilot. Bring whatever assistant your team already loves.

◎

What the scanner actually catches

IBAN (mod-97), TCKN, cards (Luhn), TR phones (mobile, landline, 08xx, +90, spaced), email, passport MRZ only (TD3, 7-3-1 check digits), and IP (IPv4/IPv6) when you turn it on. Zero-width characters, fullwidth digits and ＠, unicode dashes, and email-shaped @ / \u0040 / %40 are normalised first. Wrapped base64 or hex tokens are unwrapped only when they decode to a detector hit.

⊠

Identity cannot be switched off

policy.detectors can turn IP on or off. TCKN, cards, IBAN and email cannot be disabled — the schema rejects the key. A field longer than policy.scanCharCap (default 16 384) is replaced whole with [MASKED_PII]. It is never skipped. Skipping would be the way past the mask.

✎

Suggest, do not write

conarium-suggest-policy prints a maskColumns guess from column names. It does not write your config.

⚓

Receipt tail pin

A hash chain cannot see a tail that is no longer in the file. conarium-verify --expect-count and --expect-last-hash pin length from outside.

By design, not by omission
Still not caught by content scanners.

Most products say they catch everything. The distinguishing fact is what this one refuses to pretend to catch — because a half-working detector is worse than none.

✕

Street addresses and bare names

A street-address detector cannot tell Atatürk Caddesi from Atatürk Barajı without a gazetteer. A name detector cannot tell Deniz, Güneş or Umut from the words. Both need a dictionary or a model. This gateway's decisions are deterministic, so those stay out of the scanner. Close them with maskColumns and conarium-suggest-policy — a name-based guess that does not write your config.

✕

Out of the scanner's scope

Passport numbers outside MRZ. Double-encoded escapes such as @. An identity split across two unrelated fields.

✕

A cut from the end of the chain

The receipt chain is structurally blind to a tail that was deleted. Pin it with --expect-count, --expect-last-hash, or an external anchor.

Proven, not promised
Attacked on purpose. By our own red-team.

Most tools are merely configured to be safe. Conarium is attacked by an adversarial red-team that tries to break every policy — write-smuggling, unauthorized access, PII slipped past the mask. Whatever it bypasses, we harden — then it attacks again to verify the fix. We don't claim secure. We prove it, and re-prove it.

▸ Red-team attacks the policy
▸ Bypasses get hardened
✓ Fix re-verified by attack
Live in production
121,366 identities protected. Zero intelligence lost.

A production AI assistant runs the author's own company ERP — its customers, suppliers and staff. Every one of the 121,366 real identities is pseudonymized before it ever reaches the model. The AI reasons on opaque tokens; the operator sees the real names on the way back. Raw contact data — phone, email, tax IDs — never crosses the boundary at all. The figure cannot be verified from outside.

What the model receives
Top customer: Record #12 — ₺1.7M
Salesperson: Record #47
Phone: [redacted]
What the operator sees
Top customer: ▓▓▓▓▓ ▓▓▓▓ — ₺1.7M
Salesperson: ▓▓▓▓ ▓▓▓
Phone: on screen only
[CONARIUM-AUDIT] { pseudonymized: 121366, leaked_to_model: 0 }

Read Governance Report 001 - what it proves, what it does not, and the measurement error we made →

"Your most valuable customer is also your single biggest concentration risk — when did anyone last speak to them?"
— the assistant, reasoning on tokens it cannot de-anonymize
Verifiable from outside
Don't trust us. Run the check.

Three downloads and one verifier, on your machine, against the demo that is running right now. No account, no token, nothing of ours to install. The verifier is a single file that imports nothing from Conarium — so it cannot be the part that lies.

Run this
curl -fsS https://demo.conarium.dev/proof/chain.jsonl -o chain.jsonl curl -fsS https://demo.conarium.dev/proof/chain.jsonl.anchors.jsonl -o chain.jsonl.anchors.jsonl curl -fsS https://demo.conarium.dev/proof/key.pem -o key.pem curl -fsS https://demo.conarium.dev/proof/key.pem.keyid -o key.pem.keyid npx conarium-verify chain.jsonl --pubkey key.pem --anchor-check
What comes back
warning: anchor pending (calendar only, not yet Bitcoin-attested) ok: 3 receipt(s) verified 1/3 anchored, head anchored: yes exit 0

What this proves: the receipts were not altered, deleted, reordered or backdated after they were written, and the chain head was submitted to a public timestamp log. What it does not prove: that the records were correct at the moment they were created. The proof page says the same thing, in the same words.

See the live proof page →

Architecture
Zero Egress. Total Control.

Conarium is designed from the ground up for zero-trust environments. It runs inside your VPC, acts as a local MCP server, and ensures your raw data never leaves your perimeter.

DEVELOPER MACHINE
IDE (Cursor / Copilot)
AI Assistant
⇄
YOUR SECURE VPC
Conarium
GOVERNANCE LAYER
⇄
Postgres
Internal docs
Jira & Slack
Internal APIs
✓ MCP over stdio
✓ No Inbound Ports
✓ No External APIs
For Security Leaders
CISO F.A.Q.

Does Conarium store our data?

No. Conarium is a stateless gateway. It processes data in memory to apply masking and row caps, then streams it directly to the local MCP client. The only thing written to disk is your PII-safe audit log.

Are we training AI on our data?

Conarium intercepts PII and secrets before they reach the LLM; and because it runs self-hosted, you choose which model to use — including zero-retention endpoints — so the end-to-end data flow stays under your control.

How does it help with KVKK / GDPR?

Conarium provides an tamper-evident, append-only JSONL audit log of every database query made by AI, including the rows returned and the policies applied. This supports access-monitoring and data-governance controls.

How is Conarium deployed?

As a standalone Node.js binary or Docker container within your VPC. It communicates with developer machines entirely over standard I/O (stdio) via the Model Context Protocol, meaning absolutely no open inbound ports.

Questions people ask
Straight answers.

What does Conarium actually prevent?

Conarium sits between an AI assistant or agent and company data. Personal data is masked before the model sees it. Forbidden tables are denied at the policy level. Row caps stop bulk extraction. Every governed access is written to a hash-chained, PII-safe audit log. The gate contains no language model; masking and policy are deterministic rules.

Can I verify a receipt without installing anything?

Yes. The independent verifier is the conarium-verify binary. It runs offline, needs no Conarium installation, and makes no network call to the vendor. A receipt is checkable by someone who distrusts the vendor entirely. The published command is npx conarium-verify; passing --help prints usage without a receipt file.

What does exit code 13 mean?

Exit code 13 means the signature on a receipt or countersignature is invalid, or the keyId is unknown. Changing a field so the recomputed hash no longer matches the stored hash is exit 10. Changing the signature instead is exit 13. The verifier also uses exit 13 when a trusted public key is given without its sidecar keyid file.

Does Conarium see my data?

No. Conarium is self-hosted. The vendor never receives customer data. The process applies masking and row caps in memory, then streams the result to the local MCP client. What is written to disk is the PII-safe audit log. The product runs inside the customer's own perimeter.

How is this different from an MCP gateway with logging?

An MCP gateway with logging records that a call happened. A Conarium receipt attests to what the model was prevented from seeing, because the component that masks the data is the same component that signs the record. Coverage reconciliation then compares the database's own query counters against those receipts, so access the database recorded but no receipt covers is surfaced.

What does the receipt not prove?

A Conarium Receipt proves that records have not been altered, deleted, reordered, or backdated after they were created. It does not prove they were correct at the moment of creation. The product runs on the customer's own infrastructure, so an operator can still decide what goes into a record.

Masking before the query, row caps, EU AI Act Article 12 fields, and finding access that bypassed the gateway — four answers with their limits →

What your AI audit log cannot tell you — the access that went around the gateway, and how reconciliation finds it →

Quickstart
From zero to governed in minutes.

Deploy Conarium locally or in your VPC, configure your policy, and attach it to your IDE.

STEP 1

Install & Init

Install from npm. Current published package: @conarium-ai/core. conarium-init writes a fail-closed config and your Ed25519 keys, including the .keyid sidecars the verifier needs. Then run the doctor command init itself prints.

# Install, initialise, then the doctor line init prints
npm i @conarium-ai/core
npx conarium-init
export CONARIUM_AUDIT_SIGNING_KEY="$PWD/audit-ed25519.pem"
npx conarium-doctor --config ./conarium.config.json --no-net
# 10 commands: conarium, conarium-doctor, conarium-init,
# conarium-verify, conarium-coverage, conarium-reconcile,
# conarium-stamp, conarium-anchor-upgrade, conarium-console,
# conarium-suggest-policy
STEP 2

Define Policy

Write a simple JSON policy to define which tables are allowed, what columns to mask, and row limits.

{
  "allowTables": ["public.accounts"],
  "denyTables": ["public.card_vault"],
  "maskColumns": ["accounts.iban", "accounts.tckn"],
  "maxRows": 50
}
STEP 3

Attach to IDE

Configure Cursor or Claude Code to use Conarium via standard I/O MCP transport.

// cursor.json or mcp.json
{
  "mcpServers": {
    "conarium": {
      "command": "npx",
      "args": ["-y", "--package=@conarium-ai/core", "conarium"]
    }
  }
}
Why Conarium
Not a proxy. A witness.

A few big, well-funded companies touch this. Here is the honest difference.

Cloud maskers

They protect your data by first sending it to their servers. Conarium never sees it — it runs inside your walls.

Access gateways

They guard the door — who is allowed in. Conarium masks what is actually in the room.

AI firewalls

They stop hackers from tricking your AI. Conarium stops your own trusted AI from quietly walking out with your data.

We couldn't leak your data if we wanted to — we don't have it.

Capability
hoop.dev
MintMCP
Conarium
Data-content PII masking
✓ wire-level
not documented
✓ deterministic
Allow/deny + row caps
✓
✓
✓ row-level
Tamper-evident, PII-safe audit
session replay
✓
✓ hash-chained
Portable receipt, verifiable offline without us
not documented
not documented
✓ Ed25519
Reconciliation against the database's own counters
not documented
not documented
✓ conarium-reconcile
SOC 2 Type II
✓
✓
— we never receive your data
Self-host, platform-agnostic
✓
— SaaS
✓

Of the ten projects we scanned, none combines all three: enforcement before the model, a receipt you can verify without us, and reconciliation against the data source's own counters. That is the whole claim — we make no wider one.

Named comparison (one list): hoop.dev, Lasso, Bifrost, Docker MCP Gateway, MintMCP, Lunar MCPX — full table with numbers on compare.html. This grid shows two. Stars and last-commit dates re-measured 14 August 2026 from the GitHub API. Capability columns are from each project's own docs, last read 29–31 July 2026. “Not documented” means we could not find it documented — it does not mean the product lacks it. If we got something wrong about your project, email us and we will correct it.

See the named comparison, with numbers - including five places where they beat us →

Pricing
Open core. Self-hosted by default.

Everything technical is free and yours. What you can buy is the one thing you cannot self-host: someone other than you signing the evidence.

The core is MIT-licensed and free forever — including the reconciliation and verification tools we run ourselves. Paid tiers answer the question an auditor asks after the technical one: who else vouches for this?

Community
Free/ self-hosted
Everything technical. Forever.
  • Governed gateway — policy, PII masked before the model, allow / deny, row caps
  • Hash-chained, PII-safe audit log with Ed25519 receipts
  • All connectors — Postgres, docs, OpenAPI, Jira, Slack
  • Governance console — tables, columns and row caps
  • Coverage declaration and two-sided reconciliation — the same tools we run
  • Offline verifier — a single file that imports nothing from us
  • Community support — GitHub issues
Get started free
Pro
$20/ month
$200/year — save $40
  • Everything in Community
  • countersigned chain head — we sign the head of your chain and keep it where a third party can query it. You can timestamp it yourself; the point was never the timestamp, it is that the signer is not you.
  • Fair use — 60 submissions per minute.
  • 14-day no-questions refund. VAT added where applicable.
  • One period, not a subscription. It does not renew by itself — when the period ends, access ends and you can buy it again. 14-day no-questions refund; after that, no partial refunds.
  • Email support
Join the waitlist
Business
$100/ month
Coverage you don't have to remember to check.
  • Everything in Pro
  • ◇ In the contract, not shipped yet: reconciliation on a schedule, against your database's own counters
  • ◇ In the contract, not shipped yet: an alert when coverage breaks — activity the database recorded that no receipt covers
  • ◇ In the contract, not shipped yet: a signed period report, generated on your side; your logs never leave your servers
  • Email support
  • Launch price. When the three ◇ items ship, this tier moves to $250/month for new subscriptions.
Join the waitlist
Enterprise
from $24,000/ year
For the organisation that has to prove it to someone else.
  • Everything in Business
  • The receipt states how the identity was established — nobody hides behind a shared credential
  • Signed audit export (KVKK / GDPR)
  • A written agreement with a named legal entity — VERAX TEKNOLOJİ LİMİTED ŞİRKETİ, with a DPA
  • an independent verification endpoint — your auditor checks your claims without access to your systems and without taking your word. Shipped in the package today; the VERAX-operated endpoint is not open to customers yet.
  • ◇ In the contract, not shipped yet: one policy across every deployment, four-eyes approval for policy changes, drift detection when a gateway falls behind
  • Email support
Contact us
Compliance Pilot
$15,000fixed · 60 days
A bounded engagement, not a subscription: at the end you hold evidence your auditor can check without trusting us.
  • One data source, deployed in your environment — your logs never leave your servers
  • Governed gateway and two-sided reconciliation running against your database's own counters
  • A signed period report at the end of the pilot
  • A walkthrough of the evidence with your auditor, on a call
  • Every claim in the report is re-checkable offline — you do not have to take our word for any of it
  • Founding-customer price: $10,000 for the first three pilots, in exchange for a written case study
Talk to us about a pilot

◇ Defined in the contract, not shipped yet. Everything unmarked is in the package today — download it and run it. The countersignature you receive stays with you: it lives in your receipt and in a public timestamp log, not in our systems.

The mechanisms behind these receipts are specified in an IETF Internet-Draft — draft-dogru-scitt-disclosure-evidence — and reviewed in public on the IETF SCITT mailing list. An outside engineer has re-run the verification suite against the published vectors, on the record.

Free Risk Assessment
How exposed is your data?

Take this 30-second self-assessment to discover if your AI coding assistants are leaking sensitive PII to external models.

1. Do your engineers use AI assistants (Cursor, Copilot, etc.) that can access internal databases?

Emek Can Doğru, Founder of Conarium
From the founder

I built Conarium because I needed it myself. Our own ERP had to let AI work across 100,000+ real customer records and 10,000+ incoming messages a month — with zero chance of a leak. The governance layer that made that safe became this product.

If you're shipping AI on sensitive data and losing sleep over it, I'd like to hear from you. I answer every email personally.

Emek Can Doğru — Founder · e.dogru@conarium.dev
Design Partner Program
Give your developers the power of AI.
Without giving up control.

This form is the waitlist — Business (not shipped yet), the Compliance Pilot, Enterprise, and the Design Partner program. Pro is priced, but its checkout is not open yet, so the Pro buttons bring you here too.

Read the docsView source ★

İletişim

Conarium, aşağıdaki şirket tarafından işletilmektedir. Sorular: e.dogru@conarium.dev · +90 530 396 88 99

Ticaret unvanı
VERAX TEKNOLOJİ LİMİTED ŞİRKETİ
MERSİS no
0924116562500001
Merkez adresi
Cevizli Mah. Zuhal Cad. A Blok No:46 İç Kapı No:50 Maltepe / İstanbul 34846
Elektronik posta
e.dogru@conarium.dev
Telefon
+90 530 396 88 99

İletişim · Mesafeli Satış Sözleşmesi · İptal ve İade · Gizlilik