Unify · Resolve · Govern · Encode · Engage

Everyone can buy the same AI. No one else can buy what you know.

Hover any dot to question the graph

AIState reads every system you run, and the outside sources you trust, where they live. It catalogues them, resolves them into one institutional knowledge graph, derives the ontology from what it finds, and lets your people encode what they know as agencies, inside your boundary, every write governed. We call it Artificial Proprietary Intelligence.

See it on your own estate → Watch the live system

Systems of record · authoritative

Your systems stay where they are.

Databases, documents, SaaS, logs and outside sources are read in place and catalogued with lineage. Raw egress 0 B.

Resolve · one graph

What they hold becomes what you know.

People, organizations, accounts and devices, resolved once, with source, citation and confidence on every value.

Encode · Engage

Your people encode it. Agencies work it.

105 agencies ready and a Studio to compose more. Every write follows the autonomy you set; what you reserve waits until a person accepts it.

The Knowledge Fabric reads your databases, stores, documents, SaaS and feeds in place and resolves what they hold into a single knowledge graph. Your systems of record are read where they live: no source document, record or row is migrated, and every system of record stays authoritative. The records you choose to import — statements, transaction histories, device and system logs — are held as evidence under your key, because analysis has to be able to cite them. AIState renders that whole state as one picture your analysts can question, and agencies your own people compose work on it under review.

01 · Knowledge Fabric

Systems of record are read in place. The estate becomes one knowledge graph.

Databases, warehouses, object stores, document systems, ticketing, SIEM, streams and external feeds are read over named connections where they live. The Fabric discovers every asset, samples its schema, proposes entity types, tracks lineage and runs quality checks — nothing is catalogued by hand, and no rows leave those systems to build it. Then it does the thing a warehouse catalogue cannot: what those systems hold is resolved into one knowledge graph, and flat rows become multi-dimensional — the same customer, account, device or wallet is one object wherever it was read from, carrying its relationships, explicit and inferred. A structure you can traverse, and the canvas draws it as a whole.

Discovered, not declared. Workspaces, investigations, entity types, live sources, imports, evidence containers, the search index and every connector appear as assets with lineage — source streams graph, import loads investigation, connector enriches subject.
Resolved into one graph. Identifiers, folded names and transliteration find the same person across systems; strong identifiers or a high-confidence match before two records become one — everything in between goes to a person, and every merge is reversible.
Your schema, your model. Add an entity type in the Schema Builder and forms, colours and agency tools follow. Bring any LLM — your premises, government cloud, or a commercial endpoint you approve — under a data boundary you set per provider; raw records never leave.
Quality with an owner. Scheduled checks, incidents with an assignee, a stale feed declared on every case it touches until it returns.

How the Knowledge Fabric works → · ▶ Watch the IT-team walk-through

Read in place → resolved → one knowledge graph · every attribute keeps its source, citation and confidence

Knowledge Fabric: requests to the knowledge graph over the last 24 hours, by kind

What is read, and what is held

No system of record is migrated. What is kept is the resolved graph, your casework and the decisions on it.

Two different things get called "data", and conflating them is how vendors end up owning an estate they were only asked to read. AIState reads your systems where they live. What it keeps is the work your people and their agencies produce on top of them — on your infrastructure, under your keys, yours to export or erase.

Never copied

Your systems of record. Databases, warehouses, object stores, SaaS, ticketing, SIEM, streams and external feeds are queried over named, read-only connections with bounded results.
The catalogue. Assets, schemas, lineage and quality are discovered in place — no rows leave those systems to build it.
Systems stay where they are. The system of record stays the system of record; switching AIState off leaves it exactly as it was.

Kept for you — on your infrastructure

The resolved graph. Entities and relationships your people file and your agencies propose, each attribute carrying its source and confidence.
Records you chose to bring in, kept as rows so analysis can cite them — call records, returns, extractions, logs. Undone per import, in one action.
Monitoring events that pass your pipeline. Filters run before anything is written, and how long it stays is your number, not ours.
Cases and exhibits, kept under your key with unbroken custody and a hash-chained audit — the file your case is built on.
Decisions, approvals and agency run traces — the record of who decided what, and on what basis.

All of it inside your boundary · exportable as JSON, CSV, NDJSON or STIX · deletable on your word.

Context → agency → tools → effect within policy · a person where you reserve it

AGENCY RUN · LIVE EXECUTION TRACE · CONTEXT → MODEL → TOOLS → GRAPH

02 · Knowledge & Agentic Studio

Your people do not build software. They encode what they know — as agencies, chains and agentic widgets.

105 ready agencies — 84 across twelve disciplines (enrichment, risk, analysis, financial, communications, OSINT, legal process, case operations, reporting, triage, cyber, human intelligence) and 21 that run on a schedule or an event — and a Studio where your own people write theirs down in words, not code: purpose, the context it may read, the tools it may call, the shape of its answer, what it is allowed to change. Chains link agencies with deterministic tool calls, conditions, parallel steps and approval steps into procedures that run on a schedule or on an event. Agentic widgets answer in place — a diagram, a table, a map, a live screen — filed as an exhibit in one click.

What an agency writes follows the autonomy level you choose for the process: one of five, and you can change it at any time. Within that level it applies its declared effects. Where your authority matrix reserves the decision, it proposes, and the proposal stays out of reports until it is accepted or rolled back.
System agencies run on a schedule or on an event. A standing set of them review, validate, monitor and support intelligence across every workspace — hourly, daily, or when a case is created, a subject linked, evidence added, an alert fires — and file findings in a dock, never silent effects.
Every run shows its work. Model calls, tool calls, tokens, bytes, writes — a ledger, a DAG and a waterfall on the server clock, kept with the result for the reviewer.
The dialog is an agency too. It reads the platform's own API as an action catalogue, runs operations as you — your permissions, your audit trail — and answers with live widgets on whatever screen you are standing in.

The Studio, chains and autonomy → · ▶ Agencies in depth — the Studio, templates, chains, automation (9 min)

03 · Governed utilities

The whole state, on one canvas.

The canvas draws the knowledge graph itself — not an extract of it. Investigations render while they load; communities, betweenness, PageRank, shortest paths, timelines, maps and 3D sit on the same canvas. Live monitoring graphs take streams, webhooks, MCP pushes and file imports through visual pipelines — filter, route, alert, dedupe — held inside your boundary with the retention you set.

Investigate. Community detection with hulls, centrality rankings, paths, combos, lens, bundling; imports of call records, bank returns, chat exports and logs become entities and edges, the source records held as case evidence under your key; the canvas remembers its layout.
Monitor. Threat feeds, certificate streams, social firehoses, your own telemetry — one engine, a recency window per graph, retention on the server, alerts raised in the pipeline and picked up by the system agencies; new events animate only their neighbourhood.
Ask. ⌘K searches every index at once and frames the entity on the canvas; the dialog highlights, selects and zooms by name; every hit carries where it lives.

The canvas, screen by screen → · Live graphs and pipelines →

Communities and hubs in a large graph, the highest-betweenness node ringed

Communities · hubs · the node the network passes through

Communities drawn on an investigation graph — **Communities, drawn on the graph itself.** Hulls separate the cells while the canvas is still loading, and the layout is persisted so a reload opens settled.

LIVE MONITORING · AS IT HAPPENS

Live, as it happens. Sources and pipeline on the left, the HUD with nodes, edges, events per second and the loaded window; the analysis bar below at 1 Hz.

COMMUNITIES · DETECTED ON THE CANVAS

Communities, detected. Label propagation draws the cells; centrality shows who holds them together — computed on the canvas, over the state graph.

On screen

Every screenshot taken from the running system — nothing is a mock-up.

Shown on synthetic and public data.

The dialog embedding a real screen as a widget — **Widgets, not prose.** A case file, subject profile, live graph or Fabric section embeds as a widget — the real component, not a picture of it.

Attribute provenance: source badge, connector, tool, citation, confidence — **Provenance on every value.** Which connector and tool produced it, what the model cited, the link, confidence, who ran it and when.

A background check report — **One click, seven sections.** Identity, internal record, sanctions & PEP, registries, adverse media, courts, digital footprint — assessment, findings, gaps, actions.

The document workspace with subjects and identifiers highlighted — **Read & analyse.** Case subjects and known entities highlighted in the text, unlinked phones, IBANs and wallets, dates and amounts, related exhibits; AI readings with citations that jump into the page.

The built-in MCP hub — **Built-in hub.** Network and threat intelligence, mail, documents, people, corporate, crypto, geo, web, social, files, records — per-tool status, keys never shown.

A workflow paused for a supervisor’s approval, with its screening, scoring and review steps — **Standard notation, standard engine.** Each step names its role, approvals wait with a deadline, timers escalate; every status change is a named transition with a reason.

The book of cases: every case as a constellation, chords for what they share — **Every case, and what joins them.** Cases on a ring, a chord per connection — a shared subject, a shared identifier, a direct link, a pending match — weighted by strength, dashed when inferred.

Indicator watches with sources, scope, conditions and actions — **Sightings are recorded; watches decide.** Which sources a watch reacts to, which indicators it covers, the condition on the observation, the quiet period — and the action: notify, task, timeline entry, tag, status, run an agency.

Watch it on the live system →

Artificial Proprietary Intelligence

You already own it. AIState is how you reach it.

Everyone can buy the same AI. No one else can buy what you know. AIState does not train on your data — what it resolves becomes your Artificial Proprietary Intelligence.

What accumulates as you use it — resolved entities, relationships with their basis, institutional memory, encoded expertise, governance context and current state — is an asset no vendor can license to anyone else. General capability is rented; proprietary context is owned, and it compounds every time a governed result is kept.

If you stop using AIState you keep the asset — resolved entities, relationships with their provenance, decision records and the policy you encoded — exportable in open formats (JSON, CSV, NDJSON, STIX) through the same API the platform uses.

Read the thesis →

AIStatethe product

Artificial Proprietary Intelligencethe owned asset output

General AIrented reasoning capability

Deployment

A layer over what you already run — not a programme you move into.

Your systems stay where they are and keep their owners; the Fabric reads them in place and the state graph is the view over them. What you file and monitor is held inside your boundary, under your keys. Agencies your own people compose. Any model, under a data boundary you set per provider — your premises, government cloud, or a commercial endpoint you approve. Weeks, not quarters; no migration; no dependency on a vendor's ontology or engineers.

See the architecture →For the IT team

Unifydatabases, stores, SaaS, streams and feeds over named connections — read in place; every system of record stays authoritative
Resolveone knowledge graph of people, organizations, accounts, devices and wallets, with provenance on every attribute
Governpermissions, clearance, data boundary and approval wherever your authority matrix reserves the decision — before anything reasons or acts
Encodepolicy, procedure and expert judgement as agencies, chains and workflows your own people compose
Engagecases, investigations, monitoring and reporting — with an audit trail that includes the reads

AIState Risk™

One platform for the entire risk surface.

Compliance, AML, Fraud and Cyber are one problem seen from four desks — the same customers, counterparties, devices and accounts, split across systems that do not agree. AIState Risk is the product on that surface: detect, triage, investigate, act and report on one resolved graph, with agencies acting within your policy and approval wherever your authority matrix reserves the decision.

What AIState Risk™ does →The three layers

01Detect
Indicator registers and watches; every value the platform reads is checked against them and recorded as a sighting.
02Triage
The records a decision rests on — comms, ledgers, devices, logs — imported with their profile detected and kept as evidence.
03Investigate
Communities, centrality and paths over the resolved graph, every attribute carrying its source and confidence.
04Act & report
Case files, two-person approvals, regulatory output and a hash-chained trail a regulator can replay.

Layer 03 · governed utilities

One platform, a utility per domain of risk.

A utility is the same three layers pointed at one job — the domain lives in the ontology, the logic, the processes, the sources and the semantic context — authored as configuration, not built as new code. Three utilities run on it today: AIState Risk^™ · AIState Compliance^™ · AIState Real Estate^™.

The platform every product inherits →

Lifecycle cost

Lower cost across the whole life of the platform.

Each stage against market-standard cost.

Bring it in
40–50% lower
Weeks, not quarters — read in place, with no migration programme.
Build and extract
75–85% lower
Your people and your partner compose it. No standing team of vendor engineers.
Run it
45–65% lower
Depending on volume — the agencies carry the work, people take the decisions.
Leave it
90% lower
Systems of record were never touched. Export the identity layer, policy, decisions and audit trail.

Illustrative. Run reduction varies with volume; every figure is validated against your own estate in the proof of value.

The agency library

A bench of specialists. Hired once. Never off shift.

105 agencies ship ready — 84 specialists across twelve disciplines and 21 that never go off shift. They know the work: screen a subject, read a ledger, map a network, grade a source, draft the report. Each one reads only the case it is cleared to see, decides what to look up next, checks its own answer and acts within your policy. It hands a person only what policy reserves. Your experts add their own in plain language.

Cyber18

Case ops9

Analysis8

Financial7

Risk7

Enrichment7

Legal process6

Reporting6

OSINT5

Comms4

Triage4

HUMINT3

RetrieveThe context it is cleared to see — subject, case file, graph, workspace.

ExtractRecords, documents, identifiers and the relationships between them.

ReasonA tool loop, not a single shot: it decides what to look up next, and why.

CheckValidators, sanctions and registry calls, and review agencies that audit the output.

DraftA typed result against a schema — with the widgets and citations it carries.

ReviewEffects are declared in advance. What your authority matrix reserves waits for a person; the rest applies within policy, every step traced.

Agencies inside · approval where you reserve it · all recorded

What an agency actually is, and all 105 of them →

On a scheduleHourly, daily or weekly sweeps across every workspace, investigation and open case.

On an eventA case opened, a subject linked, evidence added, a workflow step, an alert on a live graph.

Findings, not noiseDe-duplicated per agency and target, ranked in the dock, acknowledged or dismissed by a person.

Nothing silentEvery run is recorded with its tools, tokens, duration and cost — and its full execution trace.

Watch an agency built, chained and run → · How agencies are governed →

MCP — both directions

Plug in the world. Then plug the platform into yours.

The Model Context Protocol is how the dialog and the agencies reach anything outside the graph. We host a hub of investigation tools in-process, read your own systems over named read-only connections, register any external server you trust — and expose AIState itself as an MCP server so your feeds can push straight in.

01 · built in

An investigation toolkit, built in

Runs inside your deployment, not ours. Network & threat intel, corporate registries and sanctions, crypto, people and professional profiles, geospatial, web, news and archives, social, mail, documents, files and malware, public records — grouped into families, each tool read-only and rate-friendly.

keys stored server-side · never shown · per-tool status

02 · your estate

Your own systems, read where they live

SQL warehouses and databases, document and search stores, object storage and file shares, and the SaaS your teams already run — reached over named connections that are validated read-only, statement by statement, with row caps and an egress boundary you set.

nothing copied · nothing written · every read in the ledger

03 · anyone else's

Any MCP server you trust

Register a server by URL, discover its tools, and filter which of them the dialog may see. Each connector carries a classification, so it is withheld from cases above it.

official marks · write-only headers · per-workspace scope

04 · outbound

AIState is an MCP server

Point your own agencies, pipelines and feeds at the platform: push events, upsert nodes and edges, delete — straight into a live monitoring graph, through the same pipeline filters and the same audit trail as everything else.

token per source · filters before persistence

Plus the open sources the investigation tools speak to — company registries and sanctions lists, RDAP and passive DNS, CVE and ATT&CK, blockchain explorers, court records, news archives and more.

See the hub and the connector screens → · Where it is configured →

Assurance

Built to be examined.

Hash-chained audit per case, anchored daily. Evidence encrypted at rest with the original immutable. The NIST 800-53 control baseline the platform touches, assessed against your deployment on every load, with the actions that close each gap. FIPS path, SBOMs, session lock, MFA and SSO for four identity providers.

Accreditation evidence → · Every setting and control →

ISO/IEC 27001 — Information Security Management

Everyone can buy the same AI. No one else can buy what you know.

Your systems stay where they are.

What they hold becomes what you know.

Your people encode it. Agencies work it.

Systems of record are read in place. The estate becomes one knowledge graph.

No system of record is migrated. What is kept is the resolved graph, your casework and the decisions on it.

Your people do not build software. They encode what they know — as agencies, chains and agentic widgets.

The whole state, on one canvas.

Every screenshot taken from the running system — nothing is a mock-up.

The case file, the evidence, the people — all on the same fabric.

Cases that hold up

Evidence & documents

Subjects with provenance

Governance beneath it all

Automation & policy

Records, read as evidence

Registers that keep looking

MCP, in and out

The Context-Aware Dialog, on every screen

Graphics as answers

You already own it. AIState is how you reach it.

A layer over what you already run — not a programme you move into.

One platform for the entire risk surface.

One platform, a utility per domain of risk.

Lower cost across the whole life of the platform.

Bring it in

Build and extract

Run it

Leave it

How the work is done — by the analyst, the IT team, the team lead and the agency builder.

Cyber crime — a ransomware crew, from first alert to closure

Knowledge Fabric, settings and bring-your-own LLM

Workspaces and the Context-Aware Dialog