High-fidelity signal.
No new attack surface.
Aurora runs one sensor — browser-based, inside your workforce environment and cloud, zero raw data exfiltration. Here's exactly what it touches.
The sensor
One data source: browser telemetry.
The Aurora sensor operates at the browser layer — capturing AI tool usage, account attribution, and access patterns without touching your network, intercepting traffic, or requiring changes to your IAM or SSO configuration. Deployed inside your AWS, GCP, or Azure environment. Data stays there.
Privacy model
Privacy is an architecture decision, not a policy statement.
Raw telemetry never leaves your environment. Aurora processes it inside your cloud and surfaces governed, aggregated signals. Retention policies are customer-controlled. It's designed to surface accounts and tools that governance processes need to cover.
Integration surface
Aurora doesn't replace your identity stack. It adds the layer your stack is missing.
- No changes to Okta. No modifications to your AD configuration. No IAM policy updates required.
- The sensor is additive. You get coverage for the accounts and tools that exist outside your managed identity perimeter — without touching what's inside it.
- Deployed via your existing browser MDM: Chrome Enterprise, Intune, or Jamf.
Full data pipeline
What you get
The register. The feed. The ownership layer.
- Raw usage feed: who is using which AI tools, from which department, and how often.
- Discovered vs. known: your approved tool list against what's actually running.
- Ownership resolution: service accounts mapped to owners, not just technical metadata.
- Actionable findings: block or permit discovered tools based on risk and ownership.
git clone https://github.com/aurora-identity/risk-engine docker compose up --build
Not ready to talk? You don't have to.
Everything is open source. Read the code, run it in your own environment, and come find us when you have questions.
Open source · No sandbox · Your environment