Skip to main content

Sielum — AI Agent Governance for the Endpoint

Visibility, policy enforcement and audit for every AI coding assistant running in your organization.

What is Sielum?​

Sielum is a security management platform that monitors and controls AI agents (Claude Code, Cursor, GitHub Copilot, Amazon Q, ChatGPT) on employee workstations. It gives security and IT teams:

  • Visibility — which AI agents are running, which APIs they connect to, which MCP servers they use, and which web-based AI services employees use in the browser (ChatGPT, Claude.ai, Gemini, and more)
  • Alerting — policy violations, unknown agents, unauthorized API connections
  • Control — enforce allowed/denied tool permissions, block AI API domains via firewall rules
  • Compliance — audit log, GDPR data retention, SOC 2 and EU AI Act export reports

Architecture in one diagram​

┌─────────────────────────────────────────────────────────────────┐
│                         Employee Workstation                     │
│                                                                  │
│  ┌──────────────┐   scan    ┌──────────────────────────────┐    │
│  │  AI Agents   │ ◄──────── │         Sielum Agent         │    │
│  │ Claude Code  │           │  (native binary, no Docker)  │    │
│  │    Cursor    │           └──────────────┬───────────────┘    │
│  │   Copilot    │                          │ gRPC + mTLS        │
│  │   Amazon Q   │                          │ port 443           │
│  └──────────────┘                          ▼                    │
└─────────────────────────────────────────────┼───────────────────┘
                                              │
                  agents.<host>:443  ─────────┤
                  <host>:443         ─────────┤
                                              │
                                ┌─────────────▼─────────────┐
                                │   nginx (TLS + SNI route) │
                                │   agents.* → backend:9090 │
                                │   *        → REST/SPA     │
                                └─────────────┬─────────────┘
                                              │
                          ┌───────────────────▼──────────────────┐
                          │           Sielum Server              │
                          │  ┌────────────┐  ┌───────────────┐   │
                          │  │  REST API  │  │  gRPC Server  │   │
                          │  └─────┬──────┘  └───────┬───────┘   │
                          │        └────────┬─────────┘          │
                          │           ┌─────▼──────┐             │
                          │           │ PostgreSQL │             │
                          │           └────────────┘             │
                          │  ┌──────────────────────┐            │
                          │  │  Keycloak (OIDC/SSO) │            │
                          │  └──────────────────────┘            │
                          │  ┌──────────────────────┐            │
                          │  │  Dashboard (React)   │            │
                          │  └──────────────────────┘            │
                          └──────────────────────────────────────┘

Agents only need outbound port 443 — gRPC traffic is multiplexed onto the same port as the dashboard via SNI routing on agents.<your-host>. Internal port 9090 is never exposed externally.

Quickstart​

1. Request access​

Sielum SaaS is currently in Early Access. Email sales@sielum.io and we set up your account, typically within one business day.

Once it's ready, you receive an email with a magic link. Open it, set a password, and you land directly in your new trial dashboard — a 14-day trial with all features enabled and a limit of 3 monitored AI agents.

The remaining steps below take about five minutes.

2. Follow the Setup Assistant​

On your first login, the Setup Assistant guides you through naming your organization, generating an enrollment token, and installing the agent — all in one flow. See the First Login & Setup guide for a step-by-step walkthrough.

3. Install the agent​

The assistant gives you a one-line install command for your endpoint's operating system. For manual installation and platform-specific details, see the Agent Installation guide.

4. Verify​

The assistant waits for your first endpoint to connect. The agent reports in right after installation, so this usually completes within a minute. After that, your workstation appears under Devices, with detected AI agents under Agents and observed API and web AI activity under AI Usage.

Supported AI Clients​

ClientDetectionConfig MonitoringMCP ServersEnforcement
Claude Code✅✅ ~/.claude/settings.json✅✅ (writes back settings.json)
Cursor✅✅ .cursor/mcp.json✅✅ (removes denied MCP servers)
GitHub Copilot✅✅ hosts.json—via firewall blocking
Amazon Q✅✅ SSO token cache—via firewall blocking
ChatGPT Desktop✅Process-based—via firewall blocking
Gemini CLI✅✅ settings.json—via firewall blocking
Windsurf✅✅ .windsurf/mcp.json✅via firewall blocking
OpenAI Codex✅Config path only—via firewall blocking
OpenCode✅Config path only—via firewall blocking

"Enforcement" here means writing policy back into the tool's own configuration. Tools without a writable policy surface are governed through Firewall rules and, for Claude Code, Config Guard.

Web & browser AI detection​

Beyond installed CLI and desktop clients, Sielum also detects browser-based AI usage — when an employee uses a web AI service through their browser instead of a local tool. The agent matches outbound browser connections against a built-in list of known web AI domains and reports each session (user, browser, service, domain, last seen) to the dashboard.

  • Browsers detected: Chrome / Chromium, Firefox, Edge, Safari, Brave, Arc, Opera
  • Services covered include: Claude.ai, ChatGPT, Google Gemini, Microsoft Copilot, Perplexity, xAI Grok, Poe, Character.AI, plus many content-generation tools (Midjourney, Sora, Runway, HeyGen, Jasper, and more)

This is detection only — no browser traffic is proxied or inspected, only the destination domain is matched. To block a web AI service, add its domain as a Firewall rule.

Next steps​