Start with a pilot, grow to the whole portfolio.
Tovris is priced with each organization rather than from a list. Tell us how many AI systems you govern and where Tovris has to run, and we will send a written quote.
Pilot
Prove it on your own register, with synthetic evidence.
Quoted.
One organization · synthetic data
- Your published GC AI Register entries imported, with a data-quality report
- A set of systems enriched and assessed against the DADM
- Review queue, change detection and reports in English and French
- Offline mode, or Azure OpenAI in Canada East
- Ends with a written findings report
Department
One organization, every AI system it runs.
Quoted.
One organization · production
- Everything in the pilot, plus:
- The full registry, with record history and exports
- Every available policy pack, with new versions as instruments change
- Risk monitoring, alert rules and a signed ticketing webhook
- Single sign-on with your identity provider and five roles
- Break-glass access, backups and restore drills
Portfolio
Several organizations on one deployment you control.
Quoted.
Several organizations · your infrastructure
- Everything in Department, plus:
- A separate tenant for each organization, isolated on every request
- Deployment in your Canadian cloud tenancy or on premises
- Your own Azure OpenAI deployment in a Canadian region
- The validation harness, to test Tovris on your own labels
| Compare | Pilot | Department | Portfolio |
|---|---|---|---|
| Registry | |||
| GC AI Register import and quality report | |||
| Governance fields, AIA and record history | |||
| Registry export (CSV, JSON) | |||
| Assessment and review | |||
| DADM, AIA and Policy on Service and Digital packs | |||
| Assessments with confidence and citations | Selected systems | Every system | Every system |
| Review queue and separation of duties | |||
| Batch assessment and calibration | |||
| Change and risk | |||
| Policy change detection and reassessment tasks | |||
| Risk monitoring and alert rules | Sample data | ||
| Signed webhooks and ticketing | |||
| Security and deployment | |||
| Single sign-on (OpenID Connect) and MFA | Optional | ||
| Organizations (tenants) | 1 | 1 | Several |
| Where it runs | Canada | Canadian cloud or on premises | Your tenancy or on premises |
| Language | EN · FR | EN · FR | EN · FR |
The parts that are never an option
- Every role: admin, owner, assessor, reviewer, auditor
- English and French screens, findings and reports
- Hash-chained audit log with chain verification
- Policy packs built from the official text, with stored sources
- Exports in open formats: CSV, JSON and PDF
- Canadian data residency for Government of Canada tenants
- REST API with role-scoped keys
- Read-only access for auditors
Help where a department needs it
Optional, scoped and quoted separately. The product works without them; they shorten the first months.
Register onboarding
We import your register, go through the data-quality report with you, and help owners complete governance fields and AIAs.
Policy-pack encoding
We encode another instrument, or your department's own directive, as a versioned pack built from the official text and verified quote by quote.
Deployment
We install Tovris in your tenancy or on your servers, connect your identity provider, and run a timed restore drill with your team.
Validation support
We help your team run the test harness on your own labels: agreement with experts, calibration, change detection and security tests.
Questions procurement and security teams ask
No. A tenant marked Government of Canada can only send model calls to an Azure OpenAI deployment in a Canadian region, or use offline mode, where nothing leaves the server. Every model call goes through one router that enforces this, and automated tests check it. Search embeddings are computed on the server.
Azure OpenAI in Canada East is the default for Government of Canada tenants. A provider layer routes each organization separately, and every finding records the model, region and prompt version that produced it.
Yes. Offline mode runs the whole workflow with no model provider. Its results come from a simple heuristic and are labelled that way on every run and finding, so nobody mistakes them for an assessment.
For production, yes: Tovris signs people in with OpenID Connect, for example through Keycloak or Microsoft Entra ID, and multi-factor authentication comes from your provider. A pilot can start with password sign-in.
You export it: the registry as CSV or JSON, findings and evidence lists as CSV or JSON, reports as PDF, and the audit log as CSV. Your retention settings decide what is deleted, and when.
Not yet. Tovris is new. We document how it handles security and residency, share the results of its validation and security tests, and support your own security assessment. An independent certification is on the roadmap.
Tell us your scope, we will put it in writing
How many AI systems, which organizations, and where Tovris must run. We reply with a written quote and a proposed pilot plan.
English or French · Synthetic data for every demo and pilot