Request Access →
Enterprise

Every AI tool your teams want. Compliant by default. Governed by your IdP.

Roll out ChatGPT, Claude Code, Codex, VS Code, or the apps and agents you build yourself, to the whole company in under a day. Your identity provider decides which models each team can call, and every request stays inside a boundary that's FedRAMP Equivalent, assessed at High.

Request Access → Book a compliance call
< 1 day
Contract signed to first request
8+
Tools ready on day one
1
Identity provider for every model decision
0
API keys inside a deployment package
Model access

Your identity provider decides who calls what.

Connect Microsoft Entra ID, Okta, Google Workspace, or any OpenID Connect provider. Map each group to a policy once. From then on, people get the right models the first time they sign in, with no ticket and no per-key setup.

Org ceiling FedRAMP High + ITAR
Group in your IdP
Consus policy
Their keys can call
Flight Software Engineering Every ITAR model
Program Office Chat Two approved chat models
Everyone else Org default Your baseline
  • People get the union of their groups' policies, minus anything a restrict policy takes away. Everyone else gets your default.
  • An org-wide ceiling caps it all. Set it to FedRAMP High + ITAR and no key can call anything outside it.
  • A request outside policy is refused with "contact your administrator." Tools only list the models the key can call.
  • Changes reach every key immediately, and each one is logged with the admin who made it.
Before Consus With Consus
Engineers paste program data into personal AI accounts. They get the tools they asked for, already pointed at Consus.
Someone hand-writes config for every tool on every laptop. One package per tool, pushed with Jamf, Kandji, Intune, or Group Policy.
Model access is decided key by key, in a spreadsheet. Your identity provider's groups decide. Keys follow automatically.
API keys sit in dotfiles, chat threads, and shared drives. No key in any package. The Launcher keeps it in the system keychain.
Every new model means another vendor and another review. One assessed boundary and one contract for every model you enable.
Rollout

Signed this morning. On every laptop this afternoon.

The Portal builds each package from your organization's model policy. Consus installs nothing and runs nothing on your network. You push the files with the device management you already use.

  1. 01 Pick the data ITAR, CUI, or both. Each tool is set up with only the models your policy allows for that data.
  2. 02 Pick the tools Claude Desktop ChatGPT Desktop Claude Code Codex CLI Grok Build OpenCode Pi VS Code
  3. 03 Push one package Through Jamf, Kandji, Intune, or Group Policy. Each person signs in, creates a key, and pastes one line. The Portal writes the email to your team for you.
Launcher Or skip the paste. The Consus Launcher opens Claude Desktop, ChatGPT, Claude Code, Codex, and Pi already set up. Build Building your own apps or agents? Point any OpenAI-compatible client at api.consus.io. The same policies, budgets, and logs apply.
The Portal

One console for spend, keys, and who can call what.

Every key, every dollar, and every policy, visible to your admins.

Overview

Spend & budgets

Set monthly budgets per org or per key and watch spend accrue in real time. Know what's left and when it resets.

Usage

Usage analytics

Tokens routed, total requests, error-free rate, and P95 latency across 1, 7, 30, and 90-day windows, per key and per org.

Keys

Key ownership

Every key has a named owner, set when it's created and never reassigned. Issue, limit, or revoke in seconds, and see every key by person.

Policies

Groups & policies

Groups arrive from your identity provider as people sign in. Assign each one a policy, and their keys follow.

Models

Model controls

Set an org-wide ceiling by compliance level or by model. Nothing outside it can be called, by any key.

Deployment

Ready-made packages

Packages for eight tools on macOS and Windows, built from your model policy, with a note for your team.

Day two

You'll hit these moments. Here's what happens.

A new hire joins the program

They sign in with your identity provider. Their group already maps to a policy, so their first key can call exactly the models it should.

An engineer leaves on Friday

Disable them in your IdP. Revoke their keys in the Portal, or from your offboarding script with the Management API. By Monday there's nothing to clean up.

A key leaks

Revoke it in seconds. Pull its request history from the logs API and know exactly what it was used for.

Someone asks for a model their team can't use

Their tools never listed it. If they call it anyway, the gateway refuses and tells them to contact their administrator.

An agent loops overnight

The key hits its monthly cap and the gateway stops serving it. The worst case is the budget you set, not the invoice you find.

Finance asks what AI will cost

A flat access fee, zero token markup, and usage at provider list price, capped by the budgets you set. The forecast is arithmetic.

Security review

Built to get through your security review.

Launcher

  • Open source, Apache-2.0
  • Signed by Consus Industries, notarized by Apple
  • Built only in public GitHub Actions, with SBOMs
  • No proxy, no telemetry, no background process

Portal

  • Sign-in through your identity provider, with MFA
  • System use notice before every sign-in
  • Idle sessions signed out automatically
  • Shows usage metadata, never prompt content

Packages

  • No API key in any file Consus generates
  • Consus installs nothing. You push with your MDM
  • Built from your policy, never hand-edited
  • ChatGPT's web search, browsing, and memory off

Gateway

  • FedRAMP Equivalent, assessed at High
  • US-only infrastructure, US persons in the data plane
  • Zero data retention with every model provider
  • Prompts and responses are never stored
See the full compliance posture →
Management API

Run Consus from your own tooling.

Your organization's management key can't run inference. It runs everything around it: issue and revoke keys, set limits, and read spend and request logs, scoped to your organization alone. Wire it into onboarding, offboarding, your SIEM, or the monthly report your assessor asks for.

  • POST /v1/keys Create a key with a named owner and a monthly limit
  • DELETE /v1/keys/{id} Revoke a key instantly
  • GET /v1/keys?owner= List every key a person owns
  • PATCH /v1/keys/{id}/limit Raise or lower a key's monthly limit
  • GET /v1/org Org caps, model ceiling, and month-to-date spend
  • GET /v1/spend Monthly spend and tokens per key
  • GET /v1/logs Every request: model, tokens, cost, latency, status

Keys created here follow the same model policy as keys created in the Portal. Logs are metadata only; the gateway never stores prompts or responses.

Read the Management API docs →
Onboard, offboard, audit
# A new engineer starts
curl -X POST "https://api.consus.io/v1/keys" \
    -H "x-api-key: $CONSUS_MANAGEMENT_KEY" \
    -d '{"owner": "dev@example.com", "label": "dev-laptop",
         "requested_monthly_limit_usd": 50}'

# They leave: revoke the key
curl -X DELETE "https://api.consus.io/v1/keys/a1b2c3d4e5" \
    -H "x-api-key: $CONSUS_MANAGEMENT_KEY"

# The assessor asks what it was used for
curl "https://api.consus.io/v1/logs?api_key_id=a1b2c3d4e5" \
    -H "x-api-key: $CONSUS_MANAGEMENT_KEY"

{
  "request_id": "9c5b2f1a-8d3e-4b6a-9f21-0e7c44aa1b55",
  "api_key_id": "a1b2c3d4e5",
  "model": "gpt-5.4:itar",
  "input_tokens": 1204,
  "output_tokens": 356,
  "cost": 0.00897,
  "latency_ms": 2841,
  "status": "200"
}
Questions

What every first call asks.

Can we use Consus for CUI and ITAR data?
Yes. That is what it's for. Requests run on US-only infrastructure with US persons in the data plane, and each model id carries a suffix such as :itar that names the boundary the request runs in. See the compliance posture.
What is your FedRAMP status?
FedRAMP Equivalent, assessed at High. A third-party assessor audited Consus against all 410 FedRAMP High controls. The body of evidence is available under NDA for your CMMC assessment.
How fast can we be live?
Usually the day the contract is signed, often within minutes. There's nothing to deploy: your admins sign in, set policies, and issue keys or push packages.
Which tools work with Consus?
Anything that can point at a custom API endpoint. The Portal builds ready-to-push packages for Claude Desktop, ChatGPT Desktop, Claude Code, Codex CLI, Grok Build, OpenCode, Pi, and VS Code, and the Launcher opens five of them in one click.
Can we limit which models each team uses?
Yes. Map groups from your identity provider to policies, and set an org-wide ceiling above them. Every key follows its owner's policy automatically.
What happens when someone leaves?
Disable them in your identity provider so they can't sign in, then revoke their keys in the Portal or with one Management API call. A revoked key stops working everywhere at once.
How do we pay?
An annual access fee plus usage at provider list price, with no token markup and no seats. Pay by invoice, prepaid credit, or card. See pricing.
Is there a self-serve plan?
No. Consus is for US-based defense contractors. Access is granted after a company review and a signed contract.
How to buy

Live the day you sign.

No platform to deploy, no seats to provision. Your developers keep the tools they already use. Consus sits underneath as the compliant inference layer, and the admin controls come with it.

  1. 01 Company review We verify you're a US-based defense contractor. No self-serve.
  2. 02 Contract Review and sign the Consus Cloud Service Agreement. Compliance documentation is available on request.
  3. 03 Admins sign in Through your identity provider. Map groups to policies and push packages.
  4. 04 Compliant AI Your teams open the tools they already use and get to work.
99.9% Uptime SLA

Every agreement carries a 99.9% uptime SLA. Support tiers scale with your program, up to a shared channel with the engineers who built the gateway. Full terms live in the Cloud Service Agreement.

Ways to pay Invoice Prepaid credit Card See pricing →

Bring your organization onto compliant AI

US-based defense contractors only. Access is granted after a company review and contract. No self-serve.

Request Access → Book a compliance call