Lucairn

Lucairn is a compliance gateway designed to address regulatory barriers that prevent organizations from deploying AI features involving sensitive data. It specifically targets scenarios where legal and compliance teams block AI initiatives due to concerns about exposing personal or business data to external large language model (LLM) providers such as OpenAI and Anthropic. The platform aims to provide a concrete architectural solution that satisfies regulatory requirements, rather than relying on vendor assurances or policies.

The tool operates by introducing a gateway with two distinct zones: an identity zone, which handles sensitive identifiers like names and account numbers, and an inference zone, which processes data without access to direct identifiers. Personally identifiable information (PII) is detected and tagged using a combination of Presidio, heuristic methods, and an LLM-classifier ensemble, resulting in a tagged abstract syntax tree (AST). This architecture ensures that sensitive data does not leave the organization’s network or reach external model vendors in cleartext. Every request passing through Lucairn generates a signed, customer-side audit record, which includes details such as request IDs, payload hashes, model information, modes, and a sanitizer manifest.

Lucairn’s audit trail is designed to be independently verifiable by regulators or third parties. Each record is cryptographically signed using Ed25519 over canonical JSON, includes public witness keys, RFC 3161 timestamps, and Rekor inclusion proofs, and is retained in customer-owned storage for as long as required by applicable regulations. This approach enables organizations to demonstrate compliance with frameworks such as the EU AI Act and GDPR, providing regulators with verifiable evidence of how AI features process sensitive data.

The platform is intended for developers and organizations seeking to implement AI features on real customer data while maintaining strict compliance with data protection regulations. Lucairn supports self-hosted enterprise deployment, ensuring that sensitive information remains within the customer’s network. It is positioned as a solution for unblocking AI projects that would otherwise be stalled by compliance concerns, providing a verifiable, regulator-ready audit trail for every model interaction.