How Cisora works.

The 30-second pitch

Cisora is the flight recorder and circuit breaker for every AI agent inside a company. We see what each agent does, stop it when it goes off-script, and prove control to auditors and regulators.

Two ways to integrate: a 3-line SDK that wraps existing agent code, or a BYOK gateway that proxies LLM calls without touching code. Either path unlocks the same 22 capabilities — from prompt injection detection at the gateway to tamper-evident audit logs ready for SOC 2 / ISO 27001 / EU AI Act.

Architecture

Cisora sits between your agents and the LLMs / tools they call. It is fail-open by default — if Cisora becomes unreachable, your agents continue to function. Detective controls degrade gracefully; preventive controls (policy blocks, DLP redaction) are the only thing affected.

Flow direction is top → bottom. Hover any layer for details.

Six layers, one boundary. Customer code talks to Cisora over a single HTTPS connection. Cisora speaks to LLM providers using customer-supplied BYOK credentials encrypted with AES-256-GCM. We never decrypt keys to disk, never log them, never include them in error messages.

Integration patterns — SDK vs Gateway

Two ways to integrate. You can use either, or both. Most companies start with the SDK for fast wins and add the gateway once they want inline enforcement.

import { Cisora } from '@cisora/sdk';

const cisora = new Cisora({ apiKey: process.env.CISORA_API_KEY!, agentName: 'support-bot' });

const reply = await cisora.modelCall('claude-sonnet-4-6', () =>
  anthropic.messages.create({ model: 'claude-sonnet-4-6', /* ... */ }),
);

# Before
ANTHROPIC_BASE_URL=https://api.anthropic.com

# After
ANTHROPIC_BASE_URL=https://cisora.io/api/gateway/anthropic
ANTHROPIC_API_KEY=cisora_live_…   # your Cisora key, not your Anthropic key

What happens to a single agent action

Trace one tool call through the system, end to end. Each numbered step is independently observable in the dashboard and audit log.

1. 1

   Agent receives a user message and decides to call a tool

   Captured: user message, agent identity, session id, trace id.

2. 2

   SDK or gateway intercepts the call

   Authenticates the request with your Cisora API key. Resolves your organization and per-tenant policies.

3. 3

   Rate limit check

   2,000 req/min/org default. Configurable per plan.

4. 4

   Regex injection scan

   30 patterns covering known prompt injection categories. <1ms. Blocks before the call if high-confidence match.

5. 5

   Policy engine evaluation

   Your plain-English rules compile to an 11-operator DSL. Decisions: allow, block, review. Decision latency cached <10ms.

6. 6

   Output DLP regex

   14 built-in patterns for PII (SSN, credit card, email, phone, IP) and secrets (Anthropic / OpenAI / AWS / GitHub / Stripe / Google / JWT). Block, redact, or alert per tenant policy.

7. 7

   Forward to upstream (gateway only)

   Streaming preserved. Bedrock signed with SigV4, Vertex authenticated with OAuth2 JWT-bearer. Customer’s BYOK key never leaves Cisora and is never logged.

8. 8

   Stream tee

   Response body split into two readers. One half streams to your agent immediately. The other half feeds async analysis without adding client latency.

9. 9

   Async ML classifier

   DeBERTa-v3 prompt-injection model via HuggingFace inference. If confidence > 0.85 after the stream completes, action is retroactively marked blocked and an incident is created.

10. 10

    Async embedding DLP

    MiniLM-L6-v2 cosine similarity against your indexed reference documents. Catches paraphrased data leaks that regex misses.

11. 11

    Persist + audit

    agent_action row + tamper-evident audit_log entry (SHA-256 hash chained to previous row). Each row signs the previous row’s hash.

12. 12

    Alert dispatch

    Fire-and-forget. Slack (Block Kit), Webhook (HMAC-SHA256 signed), Email (Resend). Configurable severity threshold and category filter per channel.

13. 13

    SIEM export

    Push or pull. Splunk HEC / Datadog Logs / Sumo Logic / Elastic / generic CEF / webhook.

The detection stack

Three independent layers. Each runs on every action. Their verdicts are OR-combined — any layer can trigger an incident.

Six dashboard modules

Everything you need to inventory, monitor, govern, and prove control over every AI agent in your company. One pane of glass.

Capabilities (22 phases)

Cisora ships in five blocks. Twenty-two phases. Every phase ships under one rule: does this make AI agents safer for the company running them?

Security model

Cisora is itself a security product, so we design it the way we wish our customers would. Some practices below match SOC 2 / ISO 27001 controls explicitly; others go beyond what the standards require.

Compliance frameworks

Cisora auto-generates evidence packages for six frameworks. Reports are compiled from your live activity log, OWASP-classified incidents, and the tamper-evident audit chain. PDFs are auditor-ready.

Use cases

Twelve scenarios where Cisora is the answer. Ranked by urgency, not ease.

What Cisora doesn't do

Honest scope. If you need any of these, we are not the right tool.

FAQ