Industries · Government and public sector

Citizen data needs sovereign governance. So do the agents that touch it.

Agencies run agents for citizen services, policy analysis and internal operations. Run TapPass on your own infrastructure, whitelist the models you accept, and keep data sovereign, decisions auditable and systems aligned with NIS2. No telemetry, no phone-home.

✓Free for one person · No credit card needed

Agent actions · liveself-hosted
09:05redactNational ID number removed before the model
09:11routeRestricted memo · kept on the on-premises model
09:18blockChat message tries to extract tax records
09:26holdBenefit decision · for a case officer
09:33allowAnswer a question about opening hours
What you must proveon the record
NIS2Art. 21 risk management, Art. 23 reportingevidence
EU AI ActArt. 9, 12 and 14evidence
GDPRArt. 44 to 49 transfersevidence
Data sovereigntyYour own infrastructureevidence
01What agents do in government

Agents already serve citizens. And draft the briefings.

Three agents public bodies run, and what TapPass watches on each.

Citizen services assistantAnswers questions about permits, taxes and benefits.

National IDs and tax records are removed or blocked before any model sees them.

Policy analyst agentSummarises documents and drafts briefings.

Restricted documents stay on on-premises models, internal ones go to EU providers.

Case handling agentPrepares benefit applications, permits and enforcement actions.

Every high-impact decision waits for sign-off, with tiered authorisation.

02Where it goes wrong

Why public sector AI needs sovereign governance. You cannot rely on US-hosted SaaS for it.

The EU AI Act classifies most public sector AI as high-risk.

Citizen data leaving sovereign infrastructureA citizen services chatbot sends national IDs and tax records to a US-hosted model. GDPR Art. 44 to 49 prohibits this.GDPR transfers
High-risk under the EU AI ActPublic sector AI is high-risk under the EU AI Act: Art. 9 risk management, Art. 12 record keeping and Art. 14 human oversight are required.Art. 9, 12, 14
Classified information exposureAn internal assistant summarises a restricted document, and the content flows to an external model with no clearance controls.classification
Detecting AI incidents for NIS2NIS2 Art. 21 requires risk management, and Art. 23 incident reporting within 24 hours. Most AI stacks cannot detect an AI security incident.NIS2
Adversarial attacks on public AIState-sponsored actors target government AI with prompt injection and data poisoning. Citizen-facing chatbots become attack vectors.injectionpoisoning
Transparency and accountabilityCitizens have a right to understand AI decisions that affect them. A benefit denial needs an audit trail that explains it.explainability
03The rules that matter

Public duties, as rules. Fired on every call.

Security, benefits, operations and procurement each say what must hold. TapPass makes it a rule.

The CISO says“Restricted stays on-premises. Internal goes to EU providers. Public may go anywhere.”
TapPass runsWHEN class = restricted THEN on-premises model WHEN class = internal THEN EU provider WHEN class = public THEN any approved model
What happensAnalyst agent summarises a restricted memoKept on the on-premises model
04What TapPass does

Sovereign AI governance for the public sector. Self-hosted and auditable.

Zero data leaves your infrastructure.

Self-hosted deploymentRuns on your own infrastructure with Docker, Kubernetes or a Helm chart, with no external dependencies. No telemetry, no phone-home. Air-gapped deployment is delivered with our team.Helmair-gapped
Classification-aware routingData is routed by classification level: restricted stays on-premises, internal goes to EU providers, public may go anywhere. LLM-assisted classification, forbidden zones for classified paths.multi-level
Logging for NIS2A hash-chained record with SIEM export in CEF, OCSF or JSON, OpenTelemetry tracing, and webhook and Slack incident alerts that support Art. 21 and Art. 23.CEFOCSFOpenTelemetry
Human oversight, Art. 14Benefit applications, permits and enforcement actions wait for sign-off. Configurable approval workflows, tiered authorisation and break-glass through the policy engine.tiered approval
Adversarial defenceA layered, red-team validated pipeline covers injection, exfiltration and memory poisoning, including state-sponsored attack patterns, with continuous canary testing.red-teamedcanaries
Rules for the EU AI ActPre-built rule packs for GDPR, the EU AI Act and NIS2. Art. 9 risk management through the pipeline, Art. 12 through the record, trust attestation with signed JWTs.rule packssigned JWTs
05Regulation

NIS2, the EU AI Act and GDPR, on your own infrastructure.

What each rule asks of you, and the part of the answer TapPass gives you.

RegulationWhat it asksWhat TapPass gives you
NIS2 Art. 21Risk managementCybersecurity risk management measures, including for the AI you run.Rules on every agent call, a hash-chained record and SIEM export in CEF, OCSF or JSON.
NIS2 Art. 23Incident reportingAn early warning within 24 hours of a significant incident.Automatic detection of AI security incidents, alerts to your SOC, and the timeline you need for your report.
EU AI Act Art. 9, 12, 14High-risk AIRisk management, record keeping and human oversight.Risk checks in the pipeline, a tamper-evident record, and approval gates on high-impact decisions.
GDPR Art. 44 to 49International transfersNo transfers of citizen data without a lawful basis.Citizen data kept on your own models or EU providers by rule, blocked otherwise.
Data sovereigntyYour infrastructureKeep data and control inside the organisation.Self-hosted TapPass with no telemetry and no phone-home, air-gapped if you need it.

No feature guarantees a compliance outcome. TapPass gives you the controls and the evidence that make your own answer defensible.

06Proof

Proof you can check. Not logos you have to trust.

We do not put customer names on a page unless we can show you the work. Here is what you can verify yourself, on your own agents.

Free for one personWatch your own traffic

Connect one agent in watching mode. TapPass records what it would have allowed, held, redacted or blocked, and nothing is blocked while you learn.

ReplayReplay any decision

The same rule and the same call give the same verdict, every time. Replay a decision for your auditor, or a draft rule over last week’s traffic.

Trust CenterRead the paperwork

Security controls, subprocessors, and a DPA on request. Hosted in the EU, built in Belgium.

!
ISO 27001 certification is in progress. We do not hold SOC 2 or ISO 27001 yet.

What we can show you today is the product on your own agents, the documentation behind every control in the Trust Center, and a team that answers your security questionnaire itself.

Next: Consulting and professional servicesYour consultants use AI on every client. Prove the data stays separate.
Questions

Government, in plain answers.

Something else on your mind? Talk to our team.

Can TapPass run without internet access?

Yes. TapPass runs on your own servers with no telemetry and no phone-home. Air-gapped deployments are delivered with our team.

Does TapPass help with NIS2 incident reporting?

It detects AI security incidents such as injection and exfiltration, alerts your SOC, and gives you the timeline. The early warning within 24 hours is yours to send; TapPass makes it possible to know in time.

Which models can our agents use?

Only the ones you approve. A rule allows a list of models and blocks the rest, and classification decides which data may go to which of them.

Can a citizen get an explanation of a decision?

Every decision can be replayed with the rule that applied, the data classes involved and the person who approved it, which is the basis for an explanation.

Sovereign AI governance for sovereign data.

Connect one agent and see every call TapPass would have held, stopped or routed elsewhere. Nothing is blocked while you learn.

✓ Free for one person✓ No credit cardBacked by Start it @KBCVLAIO✓ EU hosted✓ Built in Belgium✓ Your own model keys✓ Encrypted at rest and in transit✓ DPA on request