The questions buyers ask.
Answered straight, no hedging.

No. Bulwark is a control plane you call, not a proxy your traffic flows through, so there is no path where we can drop or delay your agent’s work. observe() is buffered and never raises. decide() is a synchronous call you place where you want a verdict, and with the SDK default it returns an allow marked degraded rather than throwing, so governance being unavailable cannot stop your agent. If you would rather fail closed, set fail_open=False and handle the exception in your code.

London, United Kingdom, on Fly.io with managed Postgres. A single region today, with no cross-region replica, so a regional outage is downtime for the dashboard even though it is not data loss. Data is isolated per tenant at the data layer, encrypted at rest, and TLS 1.3 in transit.

No. Content-bearing fields are stripped before anything is written to storage: prompts, completions, messages, request and response bodies, documents and transcripts. Values that pattern-match payment cards, email addresses, national identifiers, bank details, phone numbers and access tokens are masked from whatever remains. This is not a setting you have to turn on and it is not optional. Every stored record carries a marker showing what was removed, so you can prove minimisation happened rather than take our word for it.

Observability answers what your agent did and how well. Governance answers whether it was permitted to, and proves it afterwards. Different questions, different buyers, and most teams running agents in a regulated setting end up wanting both. We do not try to replace your tracing tool.

Not today. Bulwark runs as managed SaaS in a single UK region. We are not going to put a self-hosted timeline on this page that we cannot commit to. If on-premise deployment is a hard requirement for you, tell us and we will be straight about whether we are a fit yet.

Not silently. Platform operations run on a separate identity plane: those accounts are not tenant users, and a platform token is rejected outright on tenant routes. Reading your data requires a break-glass grant that is read-only, time-boxed, and recorded with a reason. The read-only property is enforced on the token itself, not just labelled in a response. Every such action is written into your own audit chain, so you can see what we did. Being straight about scale: we are a small team, and there is currently one platform-operations account, so we cannot claim a second-approver control we do not operate.

No. The quota is soft: exceeding it never blocks a decision and never stops the gate. You get threshold alerts, and the gate keeps serving. Hard-stopping enforcement because a counter moved would be exactly the kind of failure we exist to prevent.

Every record is linked into a per-tenant hash chain, so altering, deleting or reordering anything breaks every hash after it. The important part is that you verify it without us: export the bundle and run our standalone verifier, which has zero dependencies and re-implements the hash rule from the published specification rather than importing our code. Your verification key is derived for your tenant alone, so it proves your chain and is cryptographically useless against anyone else’s.

The decision path is deterministic rule matching with no model inference. Our benchmark shows p50 of 2ms and p99 of 15ms, but read that honestly: it was measured against a single process with an in-memory store on localhost, so it measures application work rather than a production round trip from your infrastructure. We have not published a production latency SLO and would rather say so than quote a number we cannot defend. If you need one for procurement, ask and we will benchmark against your region and volume.

A SIEM stores what happened. Bulwark records why an action was permitted: the identity that acted, the policy and version applied, who had authority to approve, and the outcome, as a single verifiable record. Telemetry tells you what happened; governance evidence tells you why it was allowed. You can still stream everything to your SIEM: Splunk, Sentinel and JSONL export are built in, deliberately, so we are never a system of record you are locked into.

We are deliberately honest about this. The high-risk obligations were delayed, so we do not sell false urgency around them. What is live now is the Article 50 transparency duty and the very real problem that most organisations cannot say what AI they are running. We help with the parts that apply today, and our framework mappings are evidence that supports your audits and reviews; using Bulwark does not by itself make you compliant.

No. Your data is not used to train any model, ours or anyone else’s. The policy engine is deterministic rules, not a model that learns from you. There is no model in the decision path at all, which is deliberate: a compliance gate you cannot reproduce is not a gate.

Your governance data is yours and it does not depend on us to remain useful. You can export your full audit trail at any time in open formats, and the verifier that proves it is intact runs standalone with no dependency on our software or our servers. That is the honest answer to this question: not a promise that we will still be here, but evidence that keeps working if we are not.

Yes, and it is free forever rather than a trial. Every workspace starts on Free: three governed agents with agent identity, the event chain and audit log, the policy engine in monitor mode, role-based access control and full API access, with no card and no time limit. Team is £149 a month for 10 agents and is the full technical product: enforce mode, shadow-AI discovery, MCP and tool governance, human approvals, verifiable receipts, behavioural anomaly detection, compliance packs and every integration. Business is £499 for 50 agents and adds the assurance layer on top of Team: a contractual SLA, dedicated support, security review and onboarding, with continuous-compliance and trust-centre features rolling out. We price on governed agents rather than API calls, so the question is how many agents you trust with production access.