Oximy

Employees routinely paste sensitive data such as bank details, contact information, health records and identity documents into AI tools, and coding agents can propose destructive or costly actions like deleting production data or changing deploy configs. Today employees must notice and redact this information themselves, and teams must manually check agent actions against separate budget and security rules. Companies also lack visibility into which AI tools people are actually using, including tools outside official company accounts, and struggle to connect AI spend and usage to governance needs. This leaves CIOs unable to clearly explain AI investment and risk to boards and leadership.

Oximy runs locally on Windows, Mac and Linux and inspects AI requests, files and agent actions before they go through, then allows, warns, redacts, flags for review or blocks them according to a company's written AI policy. It uses a proprietary model called Oxi-1, built by Oximy, which reads prompts, files, images, screenshots and spreadsheets to understand what a request or agent action actually contains, combined with deterministic checks. Administrators describe policy in plain language, for example blocking uploads containing customer bank details, and the system applies that rule across desktop AI apps, browser-based AI tools and coding agents. It also supports business controls such as limiting concurrent runs per person, requiring approval above a spend budget, and reviewing subscription purchases.