Announcing Astralis: governing data at machine speed

How we got here

AI's real power is that it reaches across the data boundaries every enterprise spent years building. That's the source of its value, and it's also what breaks the compliance model privacy and security have relied on for a decade. That model assumed a person could stand between the rules and the data, but AI removes the person and does it at a volume no one could review.

We've been expecting this for a long time. In 2019, when the company was seven weeks old, we wrote an internal document called "The Six Problems of Privacy." Reading it now, it signposted almost everything we've built since. We could see that privacy, governance, risk and security teams were each being handed a version of the same problem, and that left unsolved, it would eventually constrain a company's ability to innovate and compete, until it became a genuine business risk rather than a compliance one.

The problem we set out to solve

Human-centered compliance was never going to be able to ensure that software used data the way a company intended.

Through the regulation boom of the last decade, enterprises tried to demonstrate they could be trusted by producing reports, ROPAs, privacy impact assessments, snapshots of their data estate at a moment in time. The reports were often out of date before they were finished. They sat at a distance from the databases and pipelines where data was actually used, and they were supported by a first generation of software that was, underneath, workflow management and questionnaires.

We believed this model would eventually buckle under the sheer scale of the software it was meant to govern. So we set out to build something more ambitious: governance built into the systems themselves, so that trust wasn't something you proved after the fact with a document, but a byproduct of how data flowed in the first place – trust by default. That's the tooling we spent the years since building, and it's what made today's release possible.

Gradually then suddenly

In 2021 we open-sourced Fides, an ontology and shared language for describing data and the uses it's permitted for, one that every team could read and agree on. Fides is now the most widely used open-source data governance ontology in the world, running inside organizations including The New York Times, Condé Nast and Ramp.

The next year we built a single context layer on top of it, bringing together what privacy calls a data map, governance calls a catalog, security calls a vendor inventory, and risk calls an asset register, into one live picture of an organization's data.

By 2023 we'd built the orchestration to resolve permitted use directly, reasoning a person's consent and preferences against regulation, contract and role, down to the level of an individual field, and alongside it, the ability to delete, de-identify and make data safe to process, with an evidence trail behind every action.

Around this time, LLMs arrived in the enterprise mainstream, and the buckling we'd predicted stopped being a forecast. AI at scale forces a rebuild of both the tools we govern with and our expectations of what's meant by "accountability" in the first place.

What the AI era requires

In this world, a company that wants to know it's using data according to its own rules needs governance that runs end to end: one system that can decide whether a policy applies, and enforce it, at every point data is accessed, against a complete and continuously updated picture of what data is in use and what it's being used for.

That's the work we finished over the past year. Through 2025 we've been testing the last piece, applying purpose inference and policy enforcement: our LLRM (Large Language Risk & Regulatory Model) infers how data is actually being used and applies policy in real time using Fides, everywhere from a data warehouse to a SQL client, a Jupyter notebook, a BI dashboard, an LLM, or an MCP server.

The result is Astralis. The only platform that governs by intended use, against jurisdiction, customer preference, contract, and a company's own commitments, and it proves it. Purpose-based access control, applied at the moment of use, across the enterprise.

Why now

Every company is making a bet on AI to grow, and that bet depends on actually using the data it holds. Under the current model, a great deal of that data goes unused, or gets used without anyone able to say for certain whether it should have been, because the legal and contractual limits are unclear at the moment it matters.

So governance ends up saying “stop,” “no,” and “don't,” out of well-founded caution, or “we shouldn’t have” after the fact, while the rest of the business is asking it to say “yes.”

Astralis is how governance finally says yes: data used across the enterprise at full scale, governed at every point of use, with the proof to stand behind it.

We've been delivering it to our design partners. Starting today, we're opening it to everyone.

PS: I wrote separately about why we built this, and why it matters now, more personally than a launch post allows. If that's the part you care about, it's here.

Book an intro with Ethyca to see how runtime governance can transform your AI development into a true competitive advantage.

About Ethyca: Ethyca is the trusted data layer for enterprise AI, providing unified privacy, governance, and AI oversight infrastructure that enables organizations to confidently scale AI initiatives while maintaining compliance across evolving regulatory landscapes.