Company
Built in Canada.
Made to be checked.
Mandate Systems Inc. builds the control plane between organizations and their AI providers: policy enforced in-line, every decision on a record whose legal jurisdiction your counsel can evaluate.
What we're building
The product is the governance layer
Mandate is the control and accountability layer around how AI gets used in your organization. It isn't a chatbot or an AI model, and it doesn't resell AI APIs.
-
The enforcement step
A policy is a document. Mandate is the enforcement step between your users and their AI tools, with a record that exists whether or not anyone remembered to log it.
-
Evidence for auditors
Tamper-evident audit records that answer what auditors, privacy officers, and counsel actually ask: what was decided, by what rule, when, and for whom.
Why we built this
The gap between a policy on paper and proof it was enforced.
Mandate started with a pattern its founder kept seeing across organizations: a written AI usage policy, a genuine desire to enforce it, and no mechanism that gave counsel a clear view of which legal regimes can compel access to the audit record.
Enterprise governance vendors describe their data residency as a region (“ca-central-1,” “eu-west-3,” and so on). Counsel asks a different question: which corporate entity controls that infrastructure, and which legal regimes can compel them to produce the data? Region and legal jurisdiction are not the same property. The CJEU said as much in Schrems II. Canadian counsel raises the same point about CLOUD Act exposure. That gap (vendor jurisdiction as a knowable, evaluable property) is what Mandate was built to close.
The product exists to answer the question a CISO, a privacy officer, or an engineering lead runs into: how do we enforce AI policy at the point of use and produce evidence that stands up under scrutiny, on infrastructure whose legal jurisdiction we actually chose rather than inherited?
Mandate isn’t a movement against any particular country or vendor. It’s a product for organizations that want the jurisdictional posture of their AI governance to be a deliberate, documented choice. Mandate is hosted in Canada under Canadian law.
Mandate is built by Mark Petersen: twenty years shipping .NET systems and leading engineering teams, University of Waterloo computer science. If you email, he’s the one who answers.
Mark Petersen · Founder, Mandate Systems Inc.
Where we operate
Canadian-hosted today. Open to organizations anywhere.
Sovereignty is a choice: which jurisdiction governs your AI traffic and who holds the record. Canada is where that choice runs today.
-
Hosted in Canada under Canadian law
Today’s product runs on Canadian-owned infrastructure under a named legal jurisdiction your counsel can verify. For Canadian organizations, the default fit.
-
Discovery welcome from any jurisdiction
Wherever you operate, including the United States, the first conversation is about fit. We don’t turn an organization away for its address.
-
In-region deployment for qualified engagements
If your records must live under your own jurisdiction, in-region deployment can be scoped for a qualified engagement. We won’t pre-announce regions we haven’t committed to.
What we are not pursuing
Non-goals by design.
These are documented decisions. They are not on a roadmap.
-
Training on customer data
Mandate observes AI traffic to enforce policy and produce audit records. It never trains models on that traffic.
-
Undifferentiated AI API resale
Strip out the policy enforcement and the audit trail and you’re left with plain request routing. The governance is the product; we don’t resell AI APIs.
-
Client software on end-user devices
No desktop agents, no browser extensions, no mobile apps. Coverage is IT-deployed at the network layer (API gateway and forward proxy), not distributed to individual employees.