Self-hosted · Supports evidence duties under the EU AI Act · Source-available
ATF is the runtime between your models and your systems: personal data is masked before it reaches a provider. Consequential actions wait for a human. Every execution ends in signed evidence.
Detected personal data is tokenized before every provider call and restored only in the answer.
Consequential tool calls pause at the MCP Gate. No decision means rejection.
Hash-chained audit log and Ed25519-signed bundles, verifiable offline with atf-verify.
Budgets per tenant and run, routing, cascades and failover – measurable from the first request.
Each application deploys on its own and connects through versioned contracts and open protocols – an OpenAI-compatible API, MCP, HTTP. The server footprint is PostgreSQL plus five services.
apps/runtimeapps/controlapps/searchapps/gateapps/extractapps/outpostapps/outpost-desktopEvery feature in one sentence for decision makers, the details for your platform team, and a recording from the real interface.
Personal data never leaves the building.
Before any text reaches an AI model, ATF replaces names, IBANs, emails, phone numbers and health details with meaningless placeholders – and puts the real values back only in the answer your staff sees.
Governed tools instead of full access.
The Gate is the gatekeeper between AI and your systems: it only offers the actions you allow in a configuration file – and every write action can require a human.
Silence never becomes an action.
When an agent wants to move money, delete data or book something, ATF stops and asks a human. If nobody answers in time, the action is rejected – never silently executed.
The user stays the user – down to the last database row.
Whoever asks in the chat is passed through to the target system with their real sign-in. An agent can therefore never see or do more than the person it works for – and every system knows whether a human or an agent is acting.
Compliance is evidence, not assertion.
Every execution can be exported as a digitally signed evidence package. Your auditor verifies it on their own laptop – without access to your platform and without having to trust you.
Rules that apply before execution.
Which data may go to which provider, which actions need an approval and how long anything is kept is written in a reviewable file – and ATF enforces it before a model is called.
AI workflows you can review.
What an assistant or agent does is a plan in a text file. Business and IT see it as a graph in the Studio, test it with one click and change it like source code – with a version number.
Multi-step agents with a budget and a reviewer.
For complex questions a planner splits the task into steps, hands them to specialised building blocks and re-plans with the results – until a reviewer accepts the outcome or a budget is reached.
Answers in the shape your system expects.
Where an answer is processed further – a classification or a record, say – ATF forces the model into a fixed format. No “almost right” JSON that breaks your system.
Enterprise RAG on PostgreSQL.
ATF finds the passages in your documents an answer has to rest on – and only shows documents the person asking is allowed to see.
What applied on 1 March – and what has changed since?
Policies, contracts and manuals change. ATF keeps every version and, on request, answers as things stood on a given date – and shows what changed between two dates.
Documents a model actually understands.
ATF turns PDFs, office files, scans and emails into cleanly structured text with pages, tables and figures – so answers point to the right page.
Mailboxes without every reply dragging the whole history along.
ATF reads e-mails and whole mailboxes, assigns replies to their conversations and removes quoted history that is already present. Answers then rest on each statement exactly once – instead of on ten copies of the same mail.
Documents come to ATF – not the other way round.
A small sync agent runs on your side – on the file server or as a desktop app – and pushes folders, S3, Google Drive or Dropbox into the platform. The cloud never gets read access to your sources.
The return channel is checked too.
ATF checks not only what users type but also what comes back from documents and tools – because that is where attackers hide their instructions. And it attacks itself regularly.
Every answer has a résumé.
For every AI answer you see which workflow ran in which version, which sources and models were involved, how long it took and what it cost.
Predictable AI instead of a surprise invoice.
ATF knows what every request costs, stops at budget limits and fails over to another provider automatically when one goes down.
Measure changes before users feel them.
Before a new version of an assistant goes live it is tested against real examples, rolled out to a share of requests first, or tested invisibly in parallel.
Who asks decides what is visible.
Departments, subsidiaries or customers share one platform without seeing each other's data – enforced in the database, not just in the interface.
Existing clients, new control.
Existing chat interfaces and applications talk to ATF as they would to a familiar AI service – except that all your rules now apply in between.
The familiar chat interface – with every rule behind it.
Staff use a familiar chat interface such as Open WebUI. Every released workflow appears there as its own “model”; sources, approvals and progress show up directly in the chat.
Scenarios in which ATF makes the difference between a prototype and accepted operation.
An agent is to review goodwill requests and create refunds in the ERP. The requests contain bank details and medical certificates; every booking moves real money.
The agent prepares, a human decides, internal audit verifies offline.
Claims arrive as PDF, photo and email. Handlers should decide faster, but payouts and rejections must stay justified and auditable.
Shorter cycle times, every decision with source, version and approver.
Manuals, maintenance plans and incident reports live on a file server in the plant. The cloud may not access them; answers must point to the right page.
Shift leads and maintenance get evidenced answers in seconds.
Matters and files are strictly separated. AI research must never mix content from another matter into an answer – and every source has to be traceable.
Research with reliable separation and complete source evidence.
An agent is to triage tickets, narrow down causes and prepare changes. It may read a lot but change things only with approval – and token costs must stay predictable.
Faster triage without an agent touching production unasked.
An assistant is to summarize findings in plain language and answer questions. Health data (GDPR Art. 9) may only be processed under strict conditions.
Value for patients, evidence for the DPO and the regulator.
Three decisions that set ATF apart from orchestration toolkits. In depth, with code and consequences.
A second database is a second permission system. And the second permission system is the one missing in the audit.
Read more7 min read 02The attacker does not type into your chat window. They write into an email, a ticket or a PDF – and wait until your agent reads it.
Read more6 min read 03A Word document describes what is supposed to happen. A signed evidence bundle proves what did happen.
Read more8 min readATF is built and supported by Abillify Technology GmbH in Regensburg, Germany. Abillify works in payment and receivables management – an environment where evidence, data protection and approvals are everyday business. ATF grew out of production work in exactly such regulated environments.
Executive · strategy, architecture, consulting
Leads strategy, architecture and consulting at Abillify and is the author of ATF. The platform grew out of projects in regulated environments, where audit evidence, identity, data residency and approvals are preconditions for operation.
Technology · quality assurance & security
Leads the technical side at Abillify, with a focus on quality assurance and security.
Regensburg · Germany
Contacts in German and English, operation on your own infrastructure.
The complete platform code is on GitHub – Elastic License 2.0, no black-box SaaS.
Container images and Helm chart cosign-signed, with SLSA build provenance and a CycloneDX SBOM.
Every decision with context, alternatives and consequences – public in the repository.
STRIDE threat model, documented limits and a reporting path for vulnerabilities.
We publish references only with our customers' written approval – that comes with a trust product.
We are looking for pilot partners in insurance, financial services, industry and the public sector who want to take an AI use case into production with evidence.
Abillify helps companies build, integrate and operate audit-proof AI platforms based on ATF.
Target architecture, deployment on your infrastructure (Kubernetes, Docker, on-prem, EU cloud), identity and tenants.
DMS, ERP, CRM and databases connected through governed MCP tools; documents via Extract and Outpost.
Policy as code, DPIA and record-of-processing templates, EU AI Act mapping, signed evidence for DPO and audit.
Enterprise support with SLA, updates along the releases, monitoring, red teaming and cost control.
You have an AI use case or a working prototype but cannot take it live because of data protection, hallucinations or IT security? In 14 days we set up an accepted ATF instance on your own infrastructure, connect your documents and systems securely via MCP, and deliver the finished audit dossier for your data protection officer.
Not a 150,000-euro programme: a well-defined entry with a fixed price and a clear acceptance.
Request the sprint Book an architecture callThen let's talk about your architecture.