Six jobs, one record you can stand behind.
TovrisAI keeps an inventory of your AI systems, encodes the rules that apply to them, checks each system against those rules, and keeps people in charge of every conclusion. Trace, Oversee, Verify, Report, Insight, Secure: the name is the feature list.
One registry for every AI system you run
Each system is recorded with the 24 columns of the public Government of Canada AI Register, under their published names, plus the fields governance needs: owner, intended use, whether it supports an administrative decision, AIA impact level, risk tier and lifecycle stage. Every change to a record is versioned.
- Import the GC AI Register CSV; originals are kept and re-imports never duplicate
- A data-quality report flags blank statuses, spelling variants and missing flags
- An AIA questionnaire per system, with draft and final versions and the level it sets
- Export to CSV or JSON in the register's own format, ready to import again
/governance/systems
system · dept-a/0142
- aia_level
- III · final
- admin_decision
- yes
- lifecycle
- in production
- record
- version 7
People decide, and every decision is kept
Each finding waits in a review queue until an authorised reviewer validates, rejects, modifies or annotates it. Low confidence and high impact come first. When a reviewer changes a result, the model's original answer stays beside it, so the history shows both.
- A review queue ordered by confidence, impact level and age
- Validate, reject, modify or annotate, with a reason for every change
- Separation of duties: whoever ran an assessment can't approve it
- New policy versions are published by an administrator, after the impact is shown
/governance/review
finding · DADM-C-HUMAN-HIGH
- model_result
- not_met · 0.86
- review
- modified
- final_result
- partially_met
- history
- 3 entries
Every requirement checked, every answer cited
Policy instruments are encoded as versioned requirements carrying the official wording in both languages. For each system, Tovris works out which requirements apply from its AIA level and attributes, then the assessment agent checks each one against the linked evidence. Three samples feed a composite confidence score; below the threshold, the answer is “unable to determine”.
- Five results: met, partially met, not met, not applicable, unable to determine
- Every citation must exist in the evidence and contain the quoted text
- Confidence combines the model, citation support and agreement, calibrated on human labels
- Each run records the model, region, prompt version and a step-by-step trace
/governance/assessments
run · gov.assess@1.0.0
- model
- Azure OpenAI
- region
- Canada East
- samples
- 3
- requirements
- 39 apply of 45
Reports in both official languages, from one record
Generate a governance report for one system, a selection or every assessed system: scope, policy versions, results, confidence, explanations, citations, review status and open tasks. Every label exists in English and French, and text missing in one language is marked, never silently swapped.
- PDF for people, JSON and CSV for systems
- Findings and evidence exports keep the filters of the list you exported
- The numbers in a report are the numbers on the screen
- One switch sets the interface and data language, saved for each person
/governance/systems
report · portfolio
- languages
- EN · FR
- formats
- PDF · JSON · CSV
- systems
- 30 assessed
- audit
- export logged
See the whole portfolio, and what is drifting
The governance dashboard shows systems by AIA level, results by state, low-confidence findings, pending reviews, overdue tasks, policy changes and risk breaches; every count opens its list. For each system, Tovris tracks data quality, input drift and output measures such as accuracy and fairness gaps.
- Data quality: completeness, valid values and volume against a baseline
- Drift measured by Population Stability Index, with an alert line at 0.2
- A breach is filed as evidence, raises a finding and opens a reassessment task
- Alert rules, in-app notices and a signed webhook to your ticketing system
/governance
monitor · input drift
- psi
- 0.27
- alert_at
- 0.20
- status
- breach
- task
- opened · P2
Locked down, on the record, and kept in Canada
People sign in through your identity provider with OpenID Connect, and multi-factor authentication comes from it. Five roles (admin, owner, assessor, reviewer, auditor) are enforced on every API route. Every change goes into an append-only audit log, hash-chained per organization, that anyone with audit access can verify.
- Government of Canada tenants reach only Azure OpenAI in Canada, or offline mode
- The database refuses edits and deletions of audit entries
- Time-limited break-glass access, with a reason, admin alerts and flagged entries
- Idle sign-out, sign out everywhere, rate limits and upload checks
/settings
audit · chain
- organization
- dept-a
- chain
- verified · intact
- residency
- Canada only
- roles
- 5
Requirements built from the official text
A pack holds every version of an instrument: requirements, controls, applicability rules and exact quotes in English and French, each linked to the stored source and its SHA-256 hash. A person verifies the encoding before a version can be published.
- DADMAvailable
Directive on Automated Decision-Making
The 2023-04-24 and 2025-06-24 editions: 40 and 45 requirements, including the Appendix C requirements for each impact level.
- AIAAvailable
Algorithmic Impact Assessment
The official questionnaire, 70 risk and 90 mitigation questions, and the scoring that sets impact level I to IV.
- PSDAvailable
Policy on Service and Digital
Eleven system-level requirements from section 4.1: automated decisions, privacy, security, accessibility and official languages by design.
- RegisterAvailable
Government of Canada AI Register
The 24 published fields, CSV import with a data-quality report, and export in the same format.
- AI StrategyIn progress
AI Strategy for the Federal Public Service
A starter pack built the same way, from the official text.
- AI ethicsIn progress
AI ethics and responsible-use guidance
A starter pack built the same way, from the official text.
Later, same modelNIST AI RMFISO/IEC 42001EU AI Act
Connects through open, documented interfaces
A versioned REST API with role-scoped keys, signed webhooks and plain file formats. If your tools can call an API, they can feed Tovris and hear back from it.
REST API
Versioned under /api/v1, with OpenAPI documentation, pagination and one error shape.
API keys
Hashed, shown once, scoped to a role, and refused the moment they are revoked.
Webhooks
Subscribe to events. Each delivery is signed with HMAC-SHA256, retried and logged.
Ticketing
ServiceNow, Jira or any tool, through the signed ticket webhook with priorities P1 to P4.
Measures in
Push data and model measures to the risk monitor from your ML platform.
Single sign-on
OpenID Connect with Keycloak or Microsoft Entra ID; roles can come from the provider.
On the roadmapServiceNow and Jira appsMLflow · Azure ML · SageMaker · Vertex AIOpenLineageSAML and SCIMTeams and Outlook alerts
Your data stays in Canada, inside the boundary you choose
On premises, in a private cloud or in a Canadian cloud region. The registry, the assessments and the audit trail behave the same way in each.
- Isolation level 1 of 4
Canadian cloud
Run by Codebeatz in a Canadian Azure region, with Azure OpenAI in Canada East.
Azure, Canadian regions - Isolation level 2 of 4
Private cloud
The same containers in your department's own subscription and region.
Your Canadian tenancy - Isolation level 3 of 4
On premises
Behind your firewall; only HTTPS is exposed, the database stays internal.
Docker Compose - Isolation level 4 of 4
Offline mode
The full workflow with no model provider; results are labelled as a heuristic.
No model calls
Residency, by design
Every model call goes through one router. For a Government of Canada tenant it can reach only an Azure OpenAI deployment in a Canadian region, or nothing at all in offline mode. Search embeddings are computed on the server. The AI tools Codebeatz uses to write code never see Government of Canada data.
- Single sign-on with OpenID Connect; MFA from your identity provider
- Five roles, checked on the server for every route
- Hash-chained audit log per organization, verifiable on demand
- Model calls for Government of Canada tenants stay in Canada
- TLS in front; database and job queue never exposed
- Backups with checksums; a restore re-verifies every audit chain
Watch it assess a system end to end
We register a system, assess it against the DADM, review the findings and publish a policy change, live, on synthetic data.
Live walkthrough · English or French · Synthetic data only