Full audit trail from the first AI action.
11 independent defense layers, EU AI Act-ready event categories, plugin signature verification (Ed25519), and optional SIEM telemetry via Auditor. Speedwave is the first AI-SDLC platform built from the security model outward — compliance is not bolted on afterwards.
Three security risks every bank faces when engineers adopt AI tools.
You cannot stop shadow AI without providing a sanctioned alternative that is actually useful. Speedwave is that alternative.
Shadow AI is already happening
Your engineers are using ChatGPT, Claude.ai, and GitHub Copilot on personal devices. Code, customer data, and business logic enter unaudited channels daily. Telling developers to stop does not work. A sanctioned, genuinely useful alternative does.
No structured audit trail
When a regulator asks which AI systems were active, what decisions they influenced, and whether sensitive data was processed — most organisations cannot answer. Speedwave generates a structured audit log from minute one, with zero configuration.
Third party in the data path
SaaS AI platforms route all traffic through vendor infrastructure, placing a third party between your engineers and the model provider. Your API keys and code pass through systems you cannot audit. Speedwave routes directly from workstation to Anthropic.
What Speedwave gives security managers.
Defense-in-depth architecture, structured audit logging, and an open source codebase your security team can read without an NDA.
11-layer defense-in-depth
Kernel-level isolation (Lima / nerdctl / WSL2), container hardening, network isolation, credential isolation, JavaScript sandbox (22 escape patterns blocked), PII tokenisation, routing validation, SecurityCheck fail-closed gate, secret file permissions (0o600), authentication gateway, log sanitiser.
Structured audit log
Every AI action logged: READ, WRITE, DELETE, with timestamp and attribution. Log sanitisation prevents log injection. 139 event categories available via Auditor. Zero configuration required to start capturing.
EU AI Act compliance
Art. 12 full audit logging out of the box. Art. 51–52 AI System Registry via Auditor. Art. 5–6 risk classification workflow. Event categories are AI Act-aligned, not retrofitted from a generic logging framework.
Plugin signature verification
All Speedwave plugins are verified via Ed25519 signatures before execution. Unauthorised plugin substitution — a supply-chain attack vector most AI tools ignore — is blocked at the verification layer.
SIEM integration via Auditor
OTLP/HTTP telemetry push to Splunk, QRadar, Datadog, or Grafana. ISO 27001 Annex A.8.15 aligned. Your SOC sees AI actions in the same dashboard as the rest of your security telemetry.
Open source trust model
The gateway, sandbox, PII tokeniser, and audit log are Apache 2.0. Your security team reads every line without an NDA. No black-box security claims. Explicit Apache 2.0 patent grant included.
Ready to see it in your BFSI environment?
We will walk through the 11 defense layers and the audit log schema in a 30-minute technical session tailored to your threat model.