Technical summary
SmartVerify: the data security and compliance layer for enterprise AI
SmartVerify is an inline egress control plane for AI agents. It sits between AI agents (including MCP servers, RAG pipelines, and autonomous workflows) and enterprise datastores, inspecting every query and response on the wire. It observes what each agent actually does with the data it was authorized to access, applies policy in real time, and produces a per-query audit record designed for regulators and auditors.
SmartVerify complements identity tools (which govern who can enter) and DSPM tools (which map data at rest). It owns the layer neither can see: data in motion between AI agents and datastores. See the DSPM comparison for details.
Architecture and specifications
| Deployment model | Inline proxy (Envoy-based) on the agent-to-data path, deployed inside the customer VPC. Zero application code changes. |
|---|---|
| Latency | Sub-50ms added latency per request, including inspection, classification, and policy evaluation. |
| Traffic inspected | SQL, JSON/REST, vector store queries, RAG pipeline calls, and MCP (Model Context Protocol) tool calls. |
| Enforcement actions | Allow, block, mask, tokenize, redact, transform. Applied per field, per query, in real time. |
| Audit record | Immutable per-query log: agent identity, full request payload, sensitive-field labels, response disposition, timestamp. |
| Intent scoring | Real-time scoring of query purpose against behavioral baselines per agent; policies can throttle or block on intent drift. |
| Deletion propagation | Deletion requests propagated across RAG pipelines, vector stores, and caches (California DROP 45-day requirement). |
| Supported environments | AWS, Azure, Snowflake, Kubernetes. |
| Claude / Anthropic support | MCP-aware inspection of Claude tool calls; Claude Enterprise activity ingestion via the Anthropic Compliance API as a second evidence source. |
How a request flows
- An AI agent or MCP server issues a query (SQL, JSON, vector search, or MCP tool call) toward an enterprise datastore.
- The SmartVerify inline proxy intercepts the request, classifies sensitive fields, and scores the query's intent against the agent's behavioral baseline.
- Policy is applied on the wire: allow, block, mask, tokenize, or redact, in under 50 milliseconds.
- The response returns to the agent with sensitive fields transformed per policy.
- An immutable audit record is written: agent identity, full payload, labels, disposition, and compliance-framework mapping.
Model Context Protocol (MCP) security
SmartVerify is MCP-aware. It inspects tool calls issued by Claude and other MCP clients at the data path: which tool was invoked, with which arguments, and what was returned. Deployment requires no modification to MCP servers or clients; the proxy sits on the network path. For Claude Enterprise deployments, SmartVerify can also ingest conversation-plane activity via the Anthropic Compliance API and reconcile it with data-plane observations, producing dual-source evidence of what Claude actually accessed.
Regulatory mapping
| NIST AI RMF | Per-query audit records mapped to NIST AI RMF sub-categories; supports substantial-compliance evidence (affirmative defense under Texas TRAIGA). |
|---|---|
| EU AI Act | Logging and audit trails enabling post-hoc reconstruction of decision inputs and outputs for high-risk AI systems. |
| Colorado AI Act (ADAI) | Continuous monitoring of AI data access patterns to surface potentially discriminatory query behavior. |
| California DROP | Deletion propagation across AI models, vector caches, RAG pipelines, and agent logs within the 45-day window. |
| SOC 2 / HIPAA / PCI DSS / CMMC / GDPR | Signed, per-query evidence of AI agent data access mapped to existing control frameworks via dual NIST hubs. |
Packages
| AI Visibility | Audit-only mode. Immutable per-query record of every agent request and response, with sensitive fields labeled and mapped to compliance frameworks. |
|---|---|
| AI Enforcement | Real-time blocking, masking, and redaction on the wire. Deletion propagation across RAG and vector infrastructure. |
| AI Intelligence | Intent Computing: real-time intent scoring, behavioral baselines per agent, and self-correcting policy generation. |
Company
SmartVerify, Inc. is headquartered in Bellevue, Washington, and was founded by the team that built cloud-scale security and compliance services at AWS. Contact: smartverify.ai/contact. Whitepapers and research: smartverify.ai/resources.