One record, four views
Encrypted (ciphertext only), redacted (sensitive fields masked), anonymized (a realistic stand-in) or decrypted (the real value). Each is its own permission.
Let AI agents use data without seeing it.
Ascent stores each sensitive record once, and on every request policy decides which view the caller gets: encrypted, redacted, anonymized or decrypted. Agents do their work on redacted or anonymized data; real values are granted, never assumed. Self-hosted, on your own keys.
Book a demoTalk it through with us
Try the labsHands-on, synthetic data, no sign-up
Ready to try it on your own instance? Request a trial.
Self-hosted, on your own keys. No credit card.
Transcript (79 seconds)
Ascent product overview: five core features.
One: see every AI agent with access to your data, and its blast radius before it acts. Data repository by data repository, which read modes it's allowed, who armed each token, and how much it could reach: here, forty-one thousand two hundred records, thirty-seven percent of the estate, in plaintext.
Two: permissions with real granularity. Not just what can be accessed, but under what context: who is asking, agent, person or service; which data repository, record type and tags; and conditions like multi-factor authentication, signed requests, IP ranges, countries, days and hours.
Three: when an agent oversteps, it's refused in the moment, and the reason is written down in plain language. You decide what happens next with customizable response workflows: take action directly, freeze the data repository, revoke the token, alert, or push notifications to your SIEM.
Four: agents get what the task needs, and the rest stays out of reach. The same record reads four ways: redacted, anonymized, ciphertext, or plaintext, whether it's accessed by an agent, a human, or software, through the UI, the API, the CLI, MCP, or SQL. Every one is a separately permitted, separately audited read.
Five: when the auditor comes, you hand over an evidence pack built from the hash-chained audit log: signed, framework-aware, and verifiable by anyone who presses Verify.
Ascent. A modern data control plane so you can control what AI can see and do.
One record. The view each caller has earned.
Pick a view to see what comes back. A deny rule always wins, and real values are granted, never assumed.
Realistic stand-ins: the shape survives, the person does not. This is how an agent works on your data without seeing it.
emailuser_8f21@example.test
phone+1 555 010 2048
ssn000-00-2048
What you get
Approvals that expire
An agent that is refused can ask for access with a reason. A person approves exactly that, for a limited time, and it expires on its own.
Know each agent's reach
For every agent, see which records it could read, and how many decrypted, before it acts.
Three steps, on the real product.
01
Write the rules in plain terms
Who, what, which data, which view, and under what circumstances: office network, working hours, multi-factor sign-in.
02
Test before you save
See who would gain or lose access before a change takes effect, from the same engine that makes the real decisions.
03
Handle the one-offs cleanly
Standing access stays narrow. When someone needs more, a person approves it, once, with nothing to clean up later.