Question 1

Who is Ontic actually for?

Accepted Answer

We are not for casual creative use. Ontic is engineered for Regulated Industries (Healthcare, Finance, Legal) and Mission-Critical Environments (Defense, Intelligence, Energy). If your primary risk is merely reputational, you may not need us. If your risk is regulatory or kinetic (life & safety), Ontic is mandatory.

Question 2

Why can’t we just use public models like ChatGPT?

Accepted Answer

Public models offer zero liability coverage for hallucinations or data leaks. In our “Secure Edge” deployment, you move from an Unprotected risk profile to a Mandatory safety posture. We replace “Terms of Service” with a forensic guarantee.

Question 3

Do you train on our data?

Accepted Answer

In our Private and Edge deployments, never. Unlike public SaaS where you “rent” the model, Ontic provides Data Sovereignty. You own the weights, the embeddings, and the hardware. Your data never leaves your physical custody.

Question 4

How is Ontic priced?

Accepted Answer

Our pricing matches your deployment model. API (PaaS): Consumption-based (Per Token / Metered)—you pay only for the governance you use. Hosted (Private Cloud): License + Compute (committed spend). Appliance (Secure Edge): CAPEX model (Hardware + Seat License), ensuring you own the asset rather than perpetually renting capacity.

Question 5

What compliance standards does Ontic meet?

Accepted Answer

We scale compliance with risk. Our API tier carries SOC2 Type 1 certification (Ontic’s infrastructure). Our Hosted Private Cloud is HIPAA / SOC2 Type 2 certified for operating effectiveness. For Defense clients, our Appliance architecture supports ATO / FedRAMP High accreditation.

Question 6

What if the AI makes a mistake in a life-or-death situation?

Accepted Answer

We believe in Human-in-the-Loop oversight. For high-stakes actions, the system can be configured to require explicit Human Authorization (“The Kill Switch”) before executing a command. We automate the drudgery, not the responsibility.

Question 7

How do you stop the model from hallucinating?

Accepted Answer

We don’t rely on the model to “guess.” We enforce Epistemological Control. We inject Strong Context via the Oracle, lock the Mission Logic via immutable prompts, and use a strict Ontology to validate every output against your ground truth before it is shown to the user.

Question 8

Can we enforce our specific safety policies?

Accepted Answer

Yes. We don’t use generic “safe internet” filters. We implement your specific Safety Policy (e.g., “Do not recommend opioids,” “Do not reveal troop locations”) using Deterministic Guardrails. These are hard-coded constraints that the model cannot override.

Question 9

Is it safe to connect this to our internal tools?

Accepted Answer

Yes, because we use a Read-Only Sandbox. The model can use tools to fetch information (using the State Extractor), but it executes in an isolated environment with no write access to your production servers and no outbound network access.

Question 10

Can another customer’s activity affect our system?

Accepted Answer

API (PaaS): Resources are logically partitioned. We enforce Logical Isolation on shared compute, preventing tenant cross-contamination. Hosted: We enforce Hard Isolation (dedicated instances with no co-tenancy). Appliance: You get Physical Isolation on owned hardware—meaning no shared GPU memory, no context bleed, and zero risk of tenant contamination.

Question 11

What happens when someone tries to break it?

Accepted Answer

We don’t wait for a breach. While SaaS relies on Reactive Reporting, our Private and Edge tiers employ Active Simulation (Red Teaming) and Hardened Evaluation aligned with NIST AI RMF standards to proactively test against prompt injection and jailbreaks.

Question 12

Are we locked into one vendor’s model?

Accepted Answer

No. We are model-agnostic. We wrap Frontier Chatbots (e.g., GPT-4) for general tasks, but for secure environments, we deploy Fine-Tuned Open Weights (e.g., Llama 3) or Distilled Models that run locally on your hardware, freeing you from API vendor lock-in.

Question 13

Where does the system actually run?

Accepted Answer

It depends on your security needs. We deploy on everything from Public Cloud fleets to Isolated Instances (AWS Nitro). For maximum security, we deploy on Owned Hardware (e.g., Nvidia IGX, Dell XR) to ensure total physical control of the compute substrate.

Question 14

If something goes wrong, can we prove it?

Accepted Answer

Absolutely. We provide a Forensic Chain of Custody. Every token generated is logged, signed, and traceable back to the specific prompt version, data source, and user identity. It is not just a log; it is evidence.

Question 15

Can we monitor the system in real-time?

Accepted Answer

We provide deep Mission Health Observability. We don’t just track uptime; we track “drift”—monitoring whether the model’s answers are slowly deviating from your established baseline over time.

Question 16

How do we update an air-gapped system?

Accepted Answer

We do not force auto-updates. We support Secure One-Way Transfers (physical media or data diodes) so you can verify and “pin” every version update before it touches your secure network. You control the lifecycle, not us.

Question 17

What are the network requirements?

Accepted Answer

API: Requires outbound HTTPS (443) access to Ontic endpoints. Standard egress rules apply. Hosted: Ingress/Egress is restricted to your internal VPC. No public internet access required for operation (except initial package fetch if not mirrored). Appliance: Designed for Air-Gapped environments. No inbound or outbound internet access is required. Updates are applied via physical media.

Question 18

What are the compute / hardware requirements?

Accepted Answer

API: None. Compute is Ontic-hosted. Hosted: We support Isolated Instances such as AWS Nitro. Specific vCPU and RAM requirements depend on the model size (e.g., Llama 3 8B vs. 70B). You provision the cloud GPU. Appliance: We deploy on Owned Hardware certified for edge AI, such as Nvidia IGX or Dell XR servers.

Question 19

Does it require GPU?

Accepted Answer

API: No local GPU required. Hosted/Appliance: Yes. Local inference requires GPU acceleration. We support Nvidia A100/H100 for data center deployments and Orin-class processors for edge appliances.

Question 20

How does it integrate with our existing IAM / SSO?

Accepted Answer

API: Developer portal access supports SSO; API requests use key-based authentication. Hosted: Integrates with Enterprise SSO providers (Okta, Ping Identity). Appliance: Supports physical token authentication via CAC, YubiKey, or Biometrics.

Question 21

What data leaves our environment?

Accepted Answer

API: Request/response payloads transit Ontic’s infrastructure for governance processing. Data is encrypted in transit and retention is governed by your API agreement. Hosted: Zero data leaves your VPC. Appliance: Zero data leaves the box.

Question 22

How does it handle TLS / certificate management?

Accepted Answer

We support standard TLS 1.3 encryption for all data in transit. You can bring your own certificates (BYOC) or integrate with your internal PKI.

Question 23

What does the deployment process look like?

Accepted Answer

API: Sign up, provision API keys, and integrate our SDK into your application. Hosted: Deployed via standard infrastructure-as-code (Terraform/Helm charts) into your VPC. Appliance: Physical delivery of the pre-imaged server. Rack, power, and activate via local console.

Question 24

How do we configure Safety Policy and Guardrails?

Accepted Answer

Policies are defined using Policy-as-Code (leveraging Open Policy Agent — OPA). This allows you to version control your safety rules alongside your infrastructure.

Question 25

How do we configure the State Extractor and Tool Sandbox?

Accepted Answer

Routing logic and tool permissions are configured via the Ontic Control Plane. You define which tools (APIs, databases) the Read-Only Sandbox can access and strictly limit the scope of execution.

Question 26

What monitoring / observability is built in?

Accepted Answer

API: Usage logs, token counts, and cost dashboards available via the Ontic portal. Hosted: Deep Telemetry covering latency, drift, and quality, exported to your observability stack (Splunk, Datadog). Appliance: On-box telemetry and mission health dashboards.

Question 27

What does drift detection actually measure?

Accepted Answer

It measures the statistical deviation of model outputs against a “pinned” baseline of verified responses, alerting you if the model’s behavior shifts due to context changes or adversarial pressure.

Question 28

How do we handle updates and patching?

Accepted Answer

API: Transparent updates pushed by Ontic. You control adoption timing via version pinning. Hosted: Blue/Green Deployment to ensure zero-downtime updates with rollback capabilities. Appliance: Secure One-Way Transfer (physical media/data diode), allowing you to scan and verify the update package before application.

Question 29

What’s the rollback process?

Accepted Answer

Because Prompts and Policies are Immutable & Versioned, rolling back is as simple as redeploying the previous signed version manifest.

Question 30

Has the system been pen-tested?

Accepted Answer

Yes. For Private and Edge tiers, we employ Active Simulation and Red Teaming (using tools like Giskard and PyRIT) to validate security posture.

Question 31

What is the supply chain security posture?

Accepted Answer

We provide a Software Bill of Materials (SBOM) for all deployments. Our “Secure Edge” firmware is signed to ensure Forensic Chain of Custody from build to deployment.

Question 32

How are audit logs stored and protected?

Accepted Answer

Audit logs are part of the Forensic Chain of Custody. They are cryptographically signed and stored in a tamper-evident format. They can be shipped to your immutable storage (e.g., AWS S3 Object Lock) for long-term retention.

Question 33

What happens if Ontic (the company) goes away?

Accepted Answer

API: Your contract includes data portability terms and notice periods to mitigate reliance on our infrastructure. Hosted: You own the VM image and the data within your cloud; operations continue without Ontic. Appliance: You own the hardware and the perpetual license. The system continues to function indefinitely without phone-home requirements.

Frequently Asked Questions

Risk & Strategy

Architecture & Control

Accountability & Operations

IT Deployment & Operations

Pre-Deployment / Network & Security Review

Deployment & Configuration

Operations & Monitoring

Security & Compliance