“Vigil is the practice of staying awake to keep watch while everyone else sleeps.”

In the old Norse poems, Odin keeps two ravens. Every morning he sends them out across the world. Every evening they come back, settle on his shoulders, and tell him everything they saw.

Huginn

Thought

Muninn

Memory

There is a verse in the Grímnismál where Odin admits he worries about them. He fears Huginn may not come home. But he says he fears more for Muninn.

Watching is not the hard part. Remembering is. That is a strangely exact thing for a thirteenth-century poem to say about a compliance problem in 2026, and it is the reason the name stuck.

Every company we speak to can already see roughly what it spends on AI — the provider dashboard tells them. What none of them can do is prove, nine months later in front of an auditor, what a model was asked, what it answered, who asked it, and what was done about it. The seeing is broadly solved. The remembering is not. That gap is the product.

Look at how security companies draw themselves. Shields. Padlocks. Bank vaults. Firewalls with actual flames on them. The imagery varies; the promise never does. Every one of them is saying the same thing: we will stop things from moving.

That promise does not survive contact with AI.

Your engineers need the models — that is the entire reason the budget exists. Your support team is already pasting customer tickets into a chat window. Someone in finance has found a tool you have not heard of yet. If the central idea of your governance layer is no, then one of two things happens: it gets switched off, or people quietly route around it. Usually both — and the second is worse, because now the traffic exists and you cannot see it.

A raven makes a different promise. A raven does not block the road. It goes out with you, watches what happens, and comes back to report.

That is not an image we found afterwards and draped over the product. It is the architecture, literally. Vgil is a reverse proxy: your traffic still goes where it was already going, to the same providers, through the same SDKs. Nothing is walled off and nothing is rewritten. One base URL changes, and from that moment every AI call your company makes flies with a witness.

For a regulated business the second promise is the one still switched on a year later. And in audit terms that is the only thing that matters — a control nobody disables is the only kind that produces evidence.