The AI governance platform built for enterprise data
Ethyca is the AI governance platform that sits between your AI and your data. It controls how every model, agent, and system uses that data at runtime, so AI yields ROI instead of risk.
Trusted by industry leaders
AI governance that runs where your data lives
Govern every AI request at runtime
Purpose Based Access Control (PBAC) checks why data is being requested, not just who’s asking. It enforces your policies before any model or agent touches the data.
Learn about PBACKnow what sensitive data you hold, and where
Helios discovers personal and sensitive data across your warehouses, websites, and third-party apps. It can also feed what it finds into the security tools and data catalogs you already use. That gives you one current view of what data you hold and where it lives.
Learn about HeliosAutomate risk assessments continuously
Astralis replaces manual forms and template maintenance with continuous risk assessments. It knows your own policies and the laws you must follow, and analyzes risk across your data, purpose, and vendor inventories in real time.
Learn about AstralisHonestly, this is like Star Trek for data governance. Astralis has been the missing link to bring all the initiatives we’re working toward together around governance, risk, and compliance.
Built for the speed of business
200+ global brands trust Ethyca to govern their data at enterprise scale. And the numbers back it up.
150,000
Policy decisions enforced per second at runtime
1 PB
Data governed daily
5 min
Data access SLAs, cut from 6 weeks
- 150,000 — Policy decisions enforced per second at runtime
- 1 PB — Data governed daily
- 5 min — Data access SLAs, cut from 6 weeks
- 744M — Preferences processed annually
- 17.2 sec — Subject request fulfillment, cut from 15 hours
- <1 ms — Consent resolved at the edge
Runtime AI governance
What runtime AI governance means
Traditional governance assumed a person would always stand between the rules and the data. A compliance analyst filled out a form. A legal team reviewed it. Someone approved the request, and the data moved. Sometimes six weeks later. AI agents don’t fill out forms. They fire off data requests faster than any review team could read them, across warehouses, BI tools, notebooks, and MCP servers (the connectors AI agents use to reach your systems). Each request can serve a different purpose, from training a model to personalizing content to running a credit risk analysis. Runtime AI governance means your rules are checked and enforced when data is accessed, while you still have time to stop a bad request. When an agent asks for customer records, Ethyca determines the request’s purpose. It checks the purpose against your policies and allows, blocks, or flags it for a human. Ethyca logs every decision for regulators and auditors.
How Purpose Based Access Control works
Role-based access control (RBAC) answers one question. Is this person allowed to see this data? When people were the only ones requesting data, that was usually enough.
But RBAC falls apart with AI agents. An agent running a credit risk model and an agent building a marketing segment can both have access to the same customer data. What matters is what they’re doing with it. RBAC can’t tell the difference, because it checks identity and ignores purpose. Attribute-based access control (ABAC) is more precise because it checks details about the user and the data. But it still can’t see how the data will be used. So cautious teams lock data down, and your AI ends up working with far less of it than it could.
Purpose Based Access Control (PBAC) adds the layer RBAC is missing. When a person, app, SQL client, or AI agent requests data, Ethyca evaluates the request’s purpose. It checks the purpose against your policies at runtime. If the purpose is allowed, the data flows. If it’s not, the request is blocked or flagged for review. Ethyca logs every decision with an auditable trail.
How Ethyca plugs into your data stack
Ethyca runs in your infrastructure or privacy cloud and never becomes a processor of your regulated data.
The platform connects to your existing infrastructure, including your warehouses (Snowflake, BigQuery), data catalogs, BI tools, MCP servers, and AI agents. It doesn’t replace your stack; it sits alongside it and enforces policy at every point where data is accessed.
Ethyca’s mission engineers work side by side with your team during deployment. They build on the tools and catalogs you already have.
The platform has three layers that work together.
The platform has three layers that work together.
The most widely adopted ontology for labeling data categories, data uses, and purposes. It gives you a consistent language to describe what data you have and how you use it across every system.
Learn about FidesPowered by the Large Language Risk and Regulatory Model (LLRM), Ethyca’s own regulatory reasoning model. It reads your policies, contracts, and applicable regulations and turns them into enforceable rules.
Learn about AstralisEvaluates every data access request against those rules at runtime, whether the request comes from a person, an app, or an AI agent.
Learn about PBACWorks with your data stack
Govern AI and privacy with one set of rules
You can’t govern AI without governing privacy. When an agent pulls customer data, it has to respect the same consent choices and requests your privacy program already tracks. Ethyca handles both in a single layer, so you don’t need separate vendors for privacy and AI governance.
Across the platform, Ethyca has processed 4 million+ access requests and saved customers $74 million+ through automation. You get AI governance and privacy compliance from the same system, enforced by the same policies, logged in the same audit trail.
Janus
The consent orchestration engine. It models any consent or preference framework, from GDPR to CCPA, and respects user choice wherever data is accessed, including by models and AI agents. Consent is resolved in under 1 ms at the edge.
Learn about JanusLethe
Handles automated data subject requests. Ethyca has cut subject request fulfillment from 15 hours to 17.2 seconds.
Learn about LetheHelios
Maps your data inventory, finding and classifying personal and sensitive data across your systems, websites, and third-party apps.
Learn about HeliosAstralis
Automates regulatory reporting. Your records of processing activities (RoPA) stay current from what Helios discovers in your systems, instead of being rebuilt from quarterly surveys. Because Astralis generates evidence as it enforces your policies, what you hand a regulator reflects how your data is used today.
Learn about regulatory reportingAI governance for financial institutions
Banks, credit unions, and financial services firms face a specific version of this problem. You’re rolling out AI agents across lending, risk, customer support, and operations. Regulators are watching. And every data access decision has to be defensible.
Say your team builds a model to score customers’ creditworthiness. It trains on a large financial dataset, and an automated feature-selection step quietly pulls in race and ethnicity fields that sit in the same tables. Nobody meant to use race in a credit decision. But the model does, and the Equal Credit Opportunity Act bars lenders from discriminating on race. A review committee would only catch it if someone asked the right question.
Ethyca handles this at runtime. When the model requests that data, PBAC determines the purpose is a credit decision, checks it against your policies, and removes the protected attributes before the data reaches the model. The model still gets the financial data it’s allowed to use, and you get a logged, auditable record of the decision.
AI governance for publishers and consumer brands
Media and publishing
Reader data powers personalization, paywalls, and editorial decisions. It can also reveal what someone reads and believes, so publishers have to enforce data boundaries across GDPR and US state privacy laws inside the pipelines that run those products. Ethyca applies each reader’s consent and your policies wherever that data is accessed, including by models and AI agents. The New York Times runs its privacy operations on Ethyca, and Axios is a customer too.
Consumer brands
Consumer brands collect consent and preferences across websites, apps, stores, and social channels, and each of those choices has to follow the data. Janus applies every customer’s choices wherever their data is accessed, including by models and AI agents, and resolves consent in under 1 ms at the edge. Lush, Away, and Casper are Ethyca customers.
FAQs
An AI governance platform sets and enforces the rules for how models, agents, and people use enterprise data, and keeps a record of every decision. Some platforms stop at documenting policies and running review workflows. Ethyca enforces your policies at runtime, on every data request, with Purpose Based Access Control (PBAC).
Role-based access control (RBAC) checks who is asking for data. Purpose Based Access Control (PBAC) checks why. When a person, app, or AI agent requests data, Ethyca works out the purpose, checks it against your policies, and allows the request, blocks it, or flags it for review. A credit risk model and a marketing agent can get different answers about the same customer table.
No. Ethyca runs in your infrastructure or privacy cloud and never becomes a processor of your regulated data. It connects to the warehouses, data catalogs, BI tools, and MCP servers you already run, and enforces policy where data is accessed.
Plan for a small, part-time engineering commitment, not a dedicated team. Ethyca’s mission engineers work side by side with your team during deployment and build on the tools and catalogs you already have.
No. Ethyca handles consent (Janus), data subject requests (Lethe), and data inventory (Helios) in the same layer as AI governance. Both programs run on the same policies and write to the same audit trail.
Ethyca logs every data access decision, so your audit trail shows how data was used, not just who could see it. Your records of processing activities (RoPA) stay current from what Helios discovers in your systems, so the documentation you hand an auditor reflects today’s data flows.
Large enterprises with mature privacy and data governance programs that are rolling out AI across complex data. Ethyca’s strongest base is in financial services and publishing, alongside consumer brands. If you’re building a privacy program for the first time, Ethyca is likely more platform than you need today.