01
Platform Engineering & Azure DevOps Automation
Pipelines, extensions and delivery automation inside Azure DevOps. The repetitive work leaves your team's hands and becomes versioned pipeline.
TRX22 · Platforms and Business
We architect AI platforms and agents built for efficiency.
Every inference your organisation makes passes first through a layer that shields sensitive data, trims the request before the call, and records who did what, what it cost and how much energy it used.
Security and governance applied at the point of passage, rather than in a report afterwards.
- Protection
- before it leaves
- The Membrane always runs. There is no off switch
- Kernel
- Rust + Python
- BIOMA Core v2, compiled into the hot path
- Telemetry
- 1 record / request
- Cost, energy, blocks and who is accountable
Engine live
BIOMA Core v2
An efficiency kernel written in Rust, compiled and embedded in the API's hot path. It trims tool output before that output returns to the model.
- In production since
- Savings Mode
- on by default
- Unrecognised format
- passes untouched
The engine never guesses. Anything it does not recognise, such as JSON and search output, passes through without being touched.
Who we are
A product company, not a consultancy advising from the outside.
The rush to adopt generative AI has opened a structural gap: there is no governance, security or efficiency infrastructure sitting between organisations and the models they run. TRX22 builds that infrastructure.
Our own technology, validated by a reproducible benchmark, alongside a consulting arm that puts it to work in agile transformation and governance rollouts. A Brazilian company headquartered in São Paulo, working where artificial intelligence, AI governance and AI-driven business platforms meet.
Mission
To make AI adoption auditable, secure and efficient, giving companies and governments the control they currently lack over how, where and at what cost AI is used.
Vision
To be the reference AI governance infrastructure for enterprise and government: the layer between any organisation and any AI model it runs.
The layer, drawnTRX22
Engineering expertise
Four practices, every one of them measurable.
02
Multi-Agent Architecture & MCP
Agent teams with explicit roles, scope and limits, wired through MCP to internal tools and data. Each agent owns one slice, and that slice is auditable.
03
Predictive Flow Metrics & Monte Carlo Forecasting
Delivery forecasts simulated from real flow, using throughput, lead time and service level expectations, rather than estimates built on opinion.
04
FinOps Consulting for Language Models
Where the AI spend actually goes, by business unit and by owner, and which levers cut that cost without degrading what the user gets back.
Partnerships
Two, and only two: Anthropic, as a Claude Certified Partner and NVIDIA, through the Inception programme.
Cloud providers appear as technical infrastructure, never as partnerships.
The product
BIOMA Canopy, the efficiency and governance kernel between you and the AI.
A hybrid Rust and Python framework installed at the point every inference in your organisation already passes through. It does not ask your team to switch tools. It becomes the path.
Membrane · caught before dispatch01
Deterministic content linter
The Membrane inspects every request before it leaves your network and stops whatever must not circulate.
Deterministic detectors, not a model's hunch: Brazilian tax identifiers verified by check digit, card numbers by Luhn, email, secret patterns, plus your organisation's own regular expressions and dictionaries. Always on, no switch.
Core v2 · what goes in, what comes out02
FinOps optimisation
The kernel trims tool output before it returns to the model, and the dashboard shows where the AI spend is going.
BIOMA Core v2: a Rust binary compiled into the hot path of a Python API. What it does not recognise, such as JSON and search output, passes through intact by recorded decision. Savings Mode is set per organisation.
Audit · sealed layers03
An audit trail nobody rewrites
Every call leaves a chained, sealed record, and the dashboard also shows the calls where a control did not apply, with the reason why.
An append-only, chain-sealed audit log. Proof of governance is not the happy path. It is the list of cases where the rule did not fire, and why.
Organisation · Area · Project · Key04
Real-time visibility
Cost, tokens, energy and blocks by business unit, by project and by key, aggregated on the server rather than in the browser.
An Organisation, Area, Project and Virtual Key hierarchy. Every virtual key carries its own budget, rate limit and permitted models. Every query is filtered by organisation.
High-precision indicators
0
text stored
Membrane detections
A piece of sensitive data, once found, becomes a content hash. The original text never reaches the database, not even for administrators.
1
record / request
Telemetry
What it cost, how much energy it used, what was blocked and who did it. One event per request, aggregated on the server.
4
opt-in modules
Regulatory posture
Transparency (Art. 50), data incidents (Brazil's LGPD art. 48), Brazilian sector rules and governance attestations. All switched off by default.
3
states per decision
Yes · No · Pending
A regulatory decision left unanswered stays visibly pending. Silence is never read as approval, and that is the entire point of the module.
Architectural indicators, verifiable in the product. Measured savings figures are published separately, always with the source and the date of measurement.
Integration
canopy.ts
1// Any OpenAI-compatible SDK points at Canopy.
2// The virtual key carries budget, rate limit and permitted models.
3
4import OpenAI from "openai";
5
6const cliente = new OpenAI({
7 baseURL: "https://canopy.trx22.space/gateway/v1",
8 apiKey: "sk-bioma-…",
9});
10
11// governance, budget and DLP applied before dispatch
Screens in operation
Forge and Synapse · roadmap
Two sovereignty models: Canopy Cloud, and Canopy On-Premise or Offline for when the data cannot leave the premises.
How it enters your operation
Three steps, and not one of them asks your team to relearn the job.
Canopy is not another tool for the team to adopt. It installs itself on the path the calls already take.
- 01
Point the gateway
The team changes the base URL, not the tool. The proxy is OpenAI-compatible, so everything already written keeps working.
Each business unit gets a virtual key with its own budget, rate limit and permitted models.
- 02
The Membrane inspects
Before anything leaves your network, deterministic detectors sweep the request and stop whatever must not circulate.
What a detection keeps is a content hash. The sensitive text never reaches the database.
- 03
The dashboard answers
Cost, tokens, energy and blocks by unit, by project and by owner, ready for the question the board will ask.
The trail is chained and append-only. Nobody rewrites it, not even administrators.
AI Governance
Four pillars your board can genuinely verify.
Governance that exists only in a written policy does not survive an audit. These four pillars are controls that run on the path of the call and leave evidence of their own.
Privacy by Design
Sensitive data is found and stopped before it leaves your network, and what the detection keeps cannot rebuild the original.
Membrane · what does not get through
- Deterministic detectors run on the request before dispatch, not after
- A detection stores a content hash, and the sensitive text never reaches the database
- The accepted consequence: Canopy cannot identify data subjects, by design rather than by limitation
- Every query has been filtered by organisation since day one
Canopy supports the regulatory requirements. It does not certify or guarantee compliance. The four regulatory modules are opt-in and ship switched off: the organisation turns them on, and that decision is recorded.
The hard questions
What people ask before they sign.
Short answers, including the ones that do not help the sale. A verifiable “no” is worth more in a boardroom than a “yes” that does not survive an audit.
Will my team have to switch tools?
No. The gateway is OpenAI-compatible, so what changes is the base URL and everything already written keeps working. What the team gains is a virtual key per business unit, with its own budget, rate limit and permitted models.
Does sensitive data leave my infrastructure?
The Membrane inspects inside your network, before dispatch, and what it keeps from a detection is a content hash. For anyone who cannot let the data leave the premises there is Canopy On-Premise or Offline, alongside Canopy Cloud.
Does this make us compliant with Brazil's LGPD and the EU AI Act?
No, and be wary of anyone who says otherwise. Canopy supports the requirements: it records the decisions, applies the notices deterministically and keeps the evidence. Certification and guaranteed compliance are not things software delivers.
What about content the engine does not recognise?
It passes through untouched. JSON and search output go through uncompressed by recorded decision, because in those formats the engine would lose the target. It never guesses: what it does not recognise, it does not touch.
Who can delete the audit trail?
Nobody, not even administrators. The log is append-only and chained. And the dashboard also shows the calls where a control did not apply, with the reason, because that is the list an audit asks for first.
In an incident, can you tell us which data subjects were affected?
No, and that is design rather than limitation. Because the Membrane keeps hashes and never text, the product cannot re-identify anyone. The LGPD incident module records the case, counts the deadline from the moment the organisation became aware, and stores the decision to notify along with its rationale.
Contact
Looking for our first Design Partners.
If your organisation already runs AI in production and cannot say precisely what it costs, what it processed and who triggered it, that is exactly the conversation to have.
The full A/B benchmark report is sent by email on request.
Enterprise
Mid-size and large organisations already running AI in production that need to answer what it costs, what it saw and who used it.
Government
Public bodies, with a direct procurement route under Brazil's Law 14.133 via CPSI, and an On-Premise option for data that cannot leave the premises.