Sovereign Tier

Ki! Sovereign is the full-suite tier for teams, professionals, and regulated enterprises who need audit-grade privacy, custom detection rules, and verifiable compliance evidence.

Community vs. Sovereign

Feature	Community (Free)	Sovereign (€79/mo)
Local PII detection (Tiers 0–1.5)	✅	✅
Works with Claude, GPT, Ollama	✅	✅
Vault & Egress Log	✅	✅
MCP server (ki-mcp)	✅	✅
Single device	✅	✅
Custom redaction rules (regex + dict)	—	✅
Tier 2 local SLM NER	—	✅
Ed25519-signed audit receipts	—	✅
Multi-device licence sync	—	✅
Team policy configuration	—	✅
Batch document scrubbing	—	✅
Air-gap mode (local LLM only)	—	✅
Priority support	—	✅
Annual compliance report export	—	✅

---

Custom Redaction Rules

Sovereign lets you define organisation-specific masking rules that fire before any built-in detection:

Regex Rules

Write a regex pattern and Ki! masks every match with a custom token:

Pattern:  \bPROJ-[A-Z]{2,4}-\d{4,6}\b
Token:    CUSTOM_PROJECT_ID
Example:  "Working on PROJ-EU-1042" → "Working on [CUSTOM_PROJECT_ID_3a4b]"

Dictionary Rules

Upload a list of sensitive terms (internal codenames, executive names, client identifiers). Ki! does greedy longest-match at Tier 0, catching them before any regex or NER stage runs.

Rules are stored locally in your vault and synced (encrypted) across your authorised devices.

---

Per-Session Vault Isolation

For organizations dealing with highly classified material, administrators can enable Vault Isolation Mode. Instead of maintaining a monolithic database of all past de-identified terms, Vault Isolation attaches local token keys strictly to the active conversation session. The exact moment an employee deletes the chat session, the local SQLite database performs a hard purge of those specific cryptographic mappings, ensuring the local mapping key is permanently destroyed and the text can never be unmasked again.

---

Zero-Dependency Native SSO (PKCE)

Supply-chain attacks targeting third-party OAuth plugins are a critical threat vector. Ki! Sovereign sidesteps this entirely by avoiding external WebView OAuth dependencies. Our Single Sign-On integration utilizes a native, temporary loopback TCP listener strictly bound to 127.0.0.1. The authorization callback is handled locally and securely by the host OS, drastically minimizing the application’s attack surface.

---

Automated Pipeline Diagnostics

Administrators can query the internal diagnostic APIs to test end-to-end masking latency and verify the cryptographic integrity of the unmasking pipeline in real-time, serving as a fail-safe against local database corruption or policy misconfiguration.

---

Tier 2 — Local SLM NER

Sovereign includes access to the local Small Language Model (SLM) NER engine. The SLM runs as a sandboxed sidecar on your device — no network call. It catches entity types that rule-based tiers miss: unusual names, contextual references, semantic PII.

If the SLM sidecar fails or exceeds the 5-second timeout, Ki! blocks the prompt (fail-closed). The SLM never degrades silently.

---

Ed25519-Signed Audit Receipts

Every AI interaction on Sovereign produces a cryptographically signed receipt:

• What was detected (entity types, count)
• That the prompt was masked (hash of the masked form)
• When (RFC 3339 timestamp)
• Signed with your organisation’s private Ed25519 key

The receipt chain is independently verifiable. Your DPO, CISO, or external auditor can validate entries without involving Ki!. See Compliance & Audit Logs for the full schema.

---

Multi-Device Sync

A Sovereign licence covers all your authorised devices. Your settings, custom rules, and vault token mappings sync end-to-end encrypted across devices. The sync payload is encrypted with your Sovereign key — Ki!‘s servers see only ciphertext.

---

Team Policy

Sovereign team licences include a policy configuration that applies to all seats:

• Shared custom rule sets (deployed to all team members)
• Shared never-mask allowlist (e.g., your company name, product names)
• Centralised audit log aggregation
• Admin console for seat management

---

Activating Your Licence

1. Purchase Sovereign at getki.ai/pricing.
2. You receive a signed licence file by email (.ki-licence).
3. In Ki! desktop: Settings → Licence → Import Licence — or see the Import a Licence guide.
4. Restart Ki!. Sovereign features activate immediately.

---

Beta Access

During the private beta, beta testers receive 3 months of Sovereign free. Join the beta →