An AI governance platform, from Backsplice LLC.
Backsplice is made by Backsplice LLC. It gives an organization one place to register the AI systems it uses, assess them against framework packs, take each one through review and approval, and publish model and system cards that say what it decided.
Governance work should leave a record someone can check.
An organization that uses AI needs to know which systems it runs, which models and vendors sit behind them, what risk each one carries and who agreed to accept it. Backsplice keeps that in one registry, runs assessments at two levels (the organization's program and each AI system), and records every review decision with the approver and the reason.
It supports a governance program. It does not decide whether your organization meets a law or a standard; that judgment stays with your organization and its advisers.
What we hold to
People decide
Approve, approve with conditions, reject and send back are decisions a named approver makes, with a reason. Watney, the AI assistant, drafts and suggests; it does not approve, set a risk tier or publish.
Records you can check
Publishing a model or system card freezes that version with a tamper-evident seal, and the audit log is hash-chained, so a later change to either is detectable unless it is made by someone holding the application's signing key and database access.
Security built in
MFA with authenticator apps and passkeys, SAML single sign-on, SCIM provisioning and a per-organization IP allowlist, with roles for admins, contributors and auditors.
Plain pricing
Two plans with the same features. They differ in how many AI systems you register, both include Watney within a fair-use limit that scales with the plan, and neither charges per seat.
How we protect the platform
What we do to protect your account and the governance records you keep here:
HTTPS everywhere
Every page is served over HTTPS, with HSTS so browsers keep to HTTPS on every later visit.
Locked-down sessions
Session cookies are Secure, HttpOnly and SameSite=Strict.
Multi-factor sign-in
Authenticator apps (TOTP) and passkeys, alongside SAML single sign-on and SCIM provisioning.
Access you control
Roles for admins, contributors and auditors, and a per-organization IP allowlist.
Secrets encrypted
TOTP secrets, and the payment-processor API keys we store, are encrypted with AES-256-GCM; card numbers go to Stripe and never reach us.
Tamper-Evident Audit Log
Every entry is hash-chained to the one before it, so a later change to a recorded entry is detectable unless it is made by someone holding the application's signing key and database access. Tamper-evident, not immutable.