AIEGIS EYE · Endpoint AI Visibility · Explained

What is AIEGIS EYE?

See every AI agent on every laptop in your company — what they're doing, what they're allowed to do, what they tried to do.

aiegis Eye is endpoint AI visibility software. It runs on employee laptops, detects connections to AI vendors at the network layer, and logs the metadata to the customer's own infrastructure. Built in Ireland for EU data residency.

In one sentence

It's a CISO's eyes for AI.

When an employee opens ChatGPT, Claude, Copilot, Gemini or any of 20+ covered AI tools on a company laptop, aiegis Eye records the connection: which vendor, which process, which user, what timestamp. The metadata lands in the customer's own cloud — AWS, Azure, GCP, on-prem SIEM — never in AIEGIS LIMITED's hands.

The CISO gets a daily report: which teams use which AI tools, how often, on what devices. Evidence-grade, audit-ready, EU-resident.

20+
AI tools covered
100%
Data residency
≥6 mo
Min. retention where Article 26(6) applies
How it works

Endpoint sensor, customer cloud.

The architecture is two-tier and deliberately boring:

  • On the endpoint: a lightweight macOS sensor watches the network stack and application activity for outbound connections to AI tools. When it sees one, it emits a record: {vendor, process, user, host, timestamp}. No prompt content. No file contents. Metadata only. (Windows and Linux sensor support is coming soon.)
  • In the customer's cloud: the records are POSTed directly to an endpoint the customer controls. Splunk, Elastic, an S3 bucket, a custom HTTP receiver — whatever fits the customer's SIEM stack.
  • What AIEGIS LIMITED sees: nothing. We are not in the data path. Heartbeat telemetry (sensor is alive, vendor signature list is current) is the only thing that flows back — opt-in, no event data.

The same architecture is being extended in v0.6 (browser extension with prompt blocking) and v0.7 (Windows-native AI app + CLI coverage via TLS proxy). Same backbone, same data path.

Why it matters

The visibility gap is the compliance gap.

68% of organisations cannot distinguish AI agent activity from human activity (CSA + Aembit, March 2026). 99% of attack attempts against authenticated APIs originate from authenticated sources — rogue agents with legitimate credentials (Salt Security, 1H 2026).

The EU AI Act Article 26 obligation to monitor the operation of high-risk AI systems doesn't have a paperwork-only path. The deployer needs technical evidence that the monitoring actually happened — which laptops, which users, which AI tools, when. aiegis Eye produces that evidence by default, signed and append-only.

Cloud-only competitors send your logs to American servers. You forfeit EU data residency, GDPR transfer protections, and any regulator's confidence that the audit trail is yours and not the vendor's.

Frequently asked

In plain English.

What is AIEGIS EYE?

aiegis Eye is endpoint AI visibility software. It detects when employees connect to AI tools — 20+ via the browser extension (ChatGPT, Claude, Copilot, Gemini, Mistral, Perplexity, Grok, DeepSeek and more), plus Cursor and VSCode Copilot via native app monitoring. The macOS sensor is in production; Windows and Linux sensors are coming soon. It records which vendor, which process, which user, and when. Metadata only for allowed traffic; flagged or blocked prompts are captured in full. Logs go directly from the endpoint to the customer's own cloud — AIEGIS LIMITED never sees the data.

How is AIEGIS EYE different from DLP or CASB?

Traditional Data Loss Prevention and Cloud Access Security Brokers were built for SaaS apps over HTTPS proxies. They can see that someone visited chat.openai.com but not whether the connection was a human typing or an autonomous AI agent acting under that user's credentials. aiegis Eye is designed for the AI-agent era: it distinguishes agent activity from human activity, captures the process-level attribution, and runs on the endpoint so it works whether the user is on the corporate network or on a coffee-shop Wi-Fi.

Does AIEGIS EYE block AI prompts before they leave the browser?

The v0.5 sensor captures and logs — it does not block. The v0.6 browser extension (in build) adds prompt blocking on Chrome, Edge, Safari and Firefox: configurable keyword and pattern lists reject prompts containing customer data, source code, private keys or PII before they reach the AI vendor. v0.7 extends blocking to Windows-native AI apps and CLI tools via TLS proxy with corporate CA.

Does my data leave my infrastructure?

No. Logs go directly from the endpoint sensor to a destination the customer controls. AIEGIS LIMITED is not in the data path. This is a deliberate architectural choice for EU data residency and for compliance with sectoral rules (Irish public sector, healthcare, financial services) that prohibit telemetry leaving the controlled environment.

Which AI vendors does AIEGIS EYE cover?

The browser extension covers 20+ AI tools including ChatGPT, Claude, Copilot, Gemini, Mistral, Perplexity, Grok, DeepSeek, Meta AI and more — the services enterprise AI usage actually concentrates on. Cursor and VSCode Copilot are covered via native app monitoring. Coverage is updated as new tools reach enterprise adoption.

How does AIEGIS EYE support EU AI Act compliance evidence?

Every captured event is appended to an audit log (SQL-enforced, append-only). Retention is configurable; organisations subject to Article 26(6) of the EU AI Act can retain automatically generated logs for at least six months. The companion governance layer at /api/protect runs each agent action through a 15-layer policy enforcement chain and emits signed decisions that can provide evidence supporting selected Article 26 monitoring and record-keeping activities. The full mapping is at /article-26-walkthrough.