Proof

We attacked it. Then we measured.

Real AI agents, real databases, made-up records. What got through without TenWall, what got through with it, and what your privacy office can check on its own.

01 / Proof

Proof you don't have to take on trust.

1

You hold the copy

Signed checkpoints of the record go to storage your privacy office holds, not to the AI team and not to us.

2

Anyone can check it

An independent checker and a one-page report an auditor, regulator or patient advocate can read.

3

Edits are caught

Delete or change one line, and the record no longer matches your checkpoints. Even we couldn't hide it.

Monitoring and AI connector tools
  • Access per user, copied from the source system
  • Record what happened, after it happened
  • Logs kept by the vendor or the AI team
  • Watch reads
TenWall
  • Access per request: this user, this patient, this purpose
  • Refuses before data leaves the database
  • A record your privacy office verifies itself
  • Covers reads, writes and the AI's own memory

Telling the model the rules isn't enforcement. A checkpoint is.

Clickable preview See what the privacy office sees → The record check, every withheld request and the reports, with made-up data. Planned panels are marked.

02 / Test results

We attacked it. Here's what got through.

Attack runs that leaked, out of 100 Plain connector Through TenWall

Same agents, same attacks, tools served over MCP. 17 October 2026, made-up records. Every normal task was completed in both setups.

Test Without TenWall With TenWall
Real AI agents under attack3 Claude models, 2,520 runs, tools called directly or over MCP
22–80%of attack runs leaked another clinic's data
0leaked
Normal work by the same agentslooking things up, saving notes
40/40tasks done per model
40/40done, no false blocks
Inside one clinicthe Maria and Lena demo, on a real database
3of Lena's notes in Maria's summary
0and the record checked out
Direct attacks on the database28 ways to read, change or delete someone else's data
28/28got through
0/28got through
Speed costadded per request, one host
—
~1–2 msat p95: search 0.98 ms, retrieve 0.81 ms, writes 2.4 ms

Made-up patient records. Measured September–October 2026 on Qdrant 1.19.1 and a Qdrant-compatible test store. A carefully written app also leaked nothing in the AI-agent test; TenWall's case is one boundary outside every app, plus proof.

What's built today, and what a pilot adds

Built and tested today
  • Signed scopes: this user, this patient, this purpose, these sensitive labels, from a policy you control
  • Refuses or withholds anything outside the scope, before data leaves the store
  • An MCP connector, so AI agents reach the data only through TenWall (tested locally)
  • Tamper-proof record, with signed checkpoints sent to the privacy office's own server
  • An independent checker and a one-page auditor report
  • A console with timelines, flagged attempts and an integrity check
  • A scan of 28 attacks against a test copy of your database
  • A stop for one user, agent, app or token, and a freeze for everything at once
  • Watch-first mode: record what the rules would keep back before enforcing them
  • Stored embeddings never returned, even when the store would send them unasked
  • A leak test scored against your own access rules, rule by rule
Added in a hospital pilot
  • Sign-in and the Epic launch connected to your own identity provider and Epic (built and tested locally today)
  • Approved patient groups (cohorts) for quality and research work
  • Labels added automatically as notes are indexed; unlabelled sensitive notes held back
  • "Withheld" notices that name the rule
  • Break-the-glass that mirrors your EHR process
  • Connections to your monitoring tools and to the vector store you run
  • The hosted MCP connector set up for your AI platform (on our test server and tried through Claude today)

Prove the walls held.

Start with a one-day leak assessment on your own AI, using made-up data. Tell us about the assistant you're building and the decision in front of you.

Book a leak assessment Request the leak assessment kit Try the agent connector locally

The assessment uses made-up data only. TenWall runs inside your network and never sees your data. See the dashboard preview →