The Backers and the Bet
Paris-based White Circle closed an $11 million seed round in May 2026. The cap table reads like a map of the frontier AI ecosystem: Romain Huet, head of developer experience at OpenAI; Durk Kingma, OpenAI cofounder now at Anthropic; Guillaume Lample, cofounder and chief scientist at Mistral; Thomas Wolf, cofounder and chief science officer at Hugging Face; Olivier Pomel, cofounder and CEO of Datadog; François Chollet, creator of Keras; Mehdi Ghissassi, formerly of Google DeepMind; Paige Bailey of DeepMind; and David Cramer, cofounder of Sentry. Fortune, Tech.eu, and Tech Funding News reported the round within days.
The company began with a viral moment. One evening in late 2024, engineer Denis Shilov was watching a crime thriller when he crafted a prompt that bypassed the safety filters of every leading model — a universal jailbreak that could extract instructions for making drugs or building weapons. The post hit 1.4 million views on X by morning. Anthropic, OpenAI, and Hugging Face all engaged directly. Shilov was invited into Anthropic's bug bounty program. But the viral moment convinced him the problem was bigger than any single exploit.
"Companies were beginning to integrate AI models into their workflows," Shilov told Fortune, "but they had few ways to control what those systems did once users started interacting with them." Jailbreaks, he said, are only one part of the problem. "In as many ways people can misbehave, models can misbehave too. Because these models are very smart, they can do a lot more harm."
The backers' motivation traces to a structural conflict Shilov has articulated repeatedly. Model providers charge for input and output tokens even when a model refuses a harmful request, reducing the financial incentive to block abuse before it reaches the model. Researchers call the performance hit from safety training the "alignment tax": safer models can score lower on coding and reasoning benchmarks. "They have a very interesting choice of training safer and more secure models versus more performant models," Shilov said. "And then there is always a problem with trust. Why would you trust Anthropic to judge Anthropic's model outputs?"
That trust gap is the strategic rationale for an independent enforcement layer. White Circle sits between the application and the model, intercepting API calls in real time to flag or block prohibited content — malware generation, scam attempts, data leaks, hallucinated refund promises, destructive actions inside software environments. The platform has already processed more than a billion API requests across customers that include the vibe-coding startup Lovable and two of the world's largest digital banks. It holds SOC 2 Type I and II certification and HIPAA compliance.
The capital will expand the 20-person team, almost all engineers distributed across London, France, Amsterdam, and elsewhere in Europe, and accelerate product development across the U.S., U.K., and Europe. But the signal from the cap table is clearer than any roadmap: the labs building the models are betting that safety won't be solved at the training stage alone. They are putting their own money behind the guardrails.
Architecture: The Interception Layer
White Circle's core product is a real-time enforcement layer that sits between enterprise applications and the foundation models they call. A single API that supports 150 languages intercepts every request and response, scanning both directions with proprietary models trained to detect policy violations, hallucinations, prompt injection attempts, model drift, and abusive behavior. Shilov describes it as "We're actually enforcing behavior" — not just logging or alerting, but blocking or rewriting outputs before they reach users or downstream systems.
Traffic flows through White Circle's models, which evaluate each interaction against company-specific policies defined in a rule engine. Teams can write bespoke enforcement rules (rate limits, automated bans, content rewrites), and the platform's detection models improve over time through labeled feedback loops. The system supports 150 languages, a practical requirement for global deployments in finance, healthcare, and legal services.
The platform catches sensitive data leakage (customer PII, financial records, health information) before a model echoes it back. It flags hallucinations that invent refund policies, legal citations, or medical advice. It detects prompt injection attacks that try to override system instructions, and it spots model drift when a foundation model's behavior shifts after a provider update. It also tracks abusive patterns: users probing for jailbreaks, automated scripts harvesting outputs, or agents taking unauthorized actions in software environments — installing packages, deleting files, or calling external APIs beyond their scope.
Design is led by Elena Iumagulova, who said the goal was: "We wanted any team, technical or not, to be able to see exactly what their AI is doing in one place – whether they're getting visibility into their models for the first time or running AI at scale and need to catch problems fast."
The company validates its detection models through public benchmarks. In May 2025 it released CircleGuardBench, a test suite for AI moderation models under real-world conditions. More recently, KillBench ran over one million experiments across 15 models from OpenAI, Google, Anthropic, and xAI, forcing models to make life-or-death choices with varying demographic attributes. The study found that all models exhibited biases tied to nationality, religion, body type, and even mobile phone brand, and that structured output formats, the standard for production integration, amplified those biases while reducing refusal rates. Those findings feed directly back into White Circle's detection models, closing the loop between research and enforcement.
Early Pilots: Where the Rubber Meets the Road
The platform's early traction tracks with a Deloitte survey of 3,235 leaders: worker access to AI rose 50 percent year over year, and the share of companies with at least 40 percent of projects in production is on track to double within six months. That surge creates the governance gap White Circle was built to address — companies are deploying models faster than they can define, let alone enforce, what acceptable behavior looks like.
The only named production customer so far is Lovable, the vibe-coding startup that lets non-technical users ship AI applications with minimal code. Lovable's inclusion is telling: vibe coding epitomizes the "anyone can deploy" dynamic Shilov warned about. "With the rise of vibe coding, anyone can ship an AI product without knowing what that model is actually doing once it's live." Several fintech and legal firms also run the platform, though White Circle has not disclosed their identities. In those sectors, the stakes are concrete — a model that hallucinates a regulatory citation, leaks client data, or promises a refund it cannot honor creates immediate liability.
The platform's policy engine catches those failure modes in real time. It flags or blocks requests that attempt to generate malware, scams, or other prohibited content; it also detects hallucinations, sensitive-data leakage, unauthorized financial commitments, and such actions. All inspection happens through that API, designed to keep latency low enough for production workloads. White Circle has not published false-positive or false-negative rates for its enforcement layer, and no independent audit has verified its detection claims — a gap the company may need to address as regulated industries adopt the tool.
Beyond customer deployments, White Circle has used its own infrastructure to stress-test the models its customers rely on. KillBench forced models to make decisions involving human lives and found that every model exhibited biases tied to nationality, religion, body type, and even mobile-phone brand. The effect intensified when models were constrained to structured output formats (dropdowns, forms, fixed-choice selections), the very interfaces enterprises use to plug AI into products. CircleGuardBench opened a public leaderboard for moderation-model performance under realistic adversarial conditions. Both benchmarks serve a dual purpose: they advance the field's understanding of model risk, and they demonstrate the kind of continuous evaluation White Circle argues enterprises must run themselves rather than outsourcing to lab-level safety testing.
Deloitte reports that two-thirds of organizations already see productivity gains from AI, but only one-third are using it to transform core processes or business models. The rest are layering AI onto existing workflows — exactly the scenario where an external enforcement layer adds value without requiring a rewrite. As agentic workflows spread (Deloitte notes only one in five companies has mature governance for autonomous agents), the demand for runtime guardrails that operate independently of the model provider will grow. White Circle's early traction suggests the market agrees, but the real test comes when the platform must scale from billions to tens of billions of requests without becoming the bottleneck it was built to prevent.
Competitive Landscape: Three Tiers, One Gap
The AI safety tooling market includes model-lab guardrails, observability platforms that have added AI monitoring, and dedicated control-layer startups. White Circle positions itself in the third category and argues the first two leave a structural gap.
OpenAI, Anthropic, and Google DeepMind each provide safety tooling such as content filters, refusal APIs, and usage dashboards. Shilov frames their incentives as misaligned: model providers still do so even when a request is refused, reducing that motive. There is also the alignment tax — training for safety can degrade performance on coding and reasoning benchmarks, a trade-off labs manage for their own products but cannot optimize for every downstream use case. White Circle's pitch is that an independent enforcement layer deployed inside the enterprise perimeter sidesteps both conflicts.
Research from Tech Funding News notes the company operates in the broader AI observability and governance market alongside firms such as Arthur AI and WhyLabs, while larger infrastructure and monitoring companies including Datadog and Scale AI have also expanded AI monitoring capabilities.
White Circle differentiates on three axes. First, scope: it calls itself the only all-in-one enterprise solution for AI governance, unifying safety, evaluation, and optimization in that API and holds SOC 2 Type I/II plus HIPAA certification. Second, enforcement granularity: the platform lets teams define bespoke rules (rate limits, automated bans, policy-specific blockers) and sharpens its proprietary detection models with labeled feedback from each deployment. Third, empirical credibility: the KillBench study (that large-scale evaluation) and CircleGuardBench (public moderation-model benchmark) give White Circle published, reproducible evidence of model biases and guardrail failure modes.
The trade-off is latency and trust. An inline proxy adds overhead per request; White Circle has not published tail-latency figures. Enterprises must also trust a 20-person, Europe-distributed team with their most sensitive model traffic. Shilov's counter is that the vibe-coding explosion (non-technical users shipping AI apps in days) creates a control vacuum incumbents cannot fill fast enough. Whether that vacuum becomes a durable market or a feature set absorbed by the labs and the observability giants remains to be seen.
Regulatory Alignment: The Compliance Clock
In August 2026 the EU AI Act entered full force, imposing a mandatory training-data disclosure regime on any high-risk system that generates content for commercial use. The rule requires providers to publish a structured dossier detailing the provenance, licensing status, and pre-processing steps for every dataset used to train a model that can produce text, image, or audio outputs. A technical annex released during the two-year transition period specified a JSON-LD schema for those data-sheet entries, a standard that many SaaS vendors have already begun to embed in their CI/CD pipelines. Non-compliance triggers fines of up to 6 percent of global annual turnover — a figure that dwarfs the penalties for earlier privacy violations.
Parallel to the AI Act, the Network and Information Security 2 (NIS2) Directive establishes more rigorous cybersecurity requirements for organizations in EU member states, with a transposition deadline that passed in October 2024. Most countries align with the directive's 24-hour incident reporting schedule, though Cyprus imposes a six-hour early warning and Lithuania requires automated reporting. The directive's emphasis on management accountability is clear: executive boards and managing directors are mandated to ensure compliance with risk-management measures.
In the United States, federal and state regulators are advancing AI governance frameworks, with NIST developing evaluation frameworks that feed into procurement rules for federal contractors. State-level action is also emerging. The patchwork means enterprises operating across jurisdictions need a single observability layer that can emit evidence packages tailored to each regulator's schema.
White Circle's architecture (API interception, policy engine, anomaly detection) maps directly to these obligations. The platform's ability to log every model call, tag the data lineage of each request, and enforce policy gates at inference time produces audit trails aligned with the EU AI Act's Annex IV demands: records of training data provenance, risk-mitigation measures, and post-market monitoring results. When a regulator asks for the JSON-LD data sheet for a deployed model, the platform can generate it from live metadata rather than from a manual spreadsheet assembled weeks before a deadline.
The same interception layer satisfies NIS2's incident-reporting mandates. Anomaly detection flags unusual data exfiltration patterns or prompt-injection attempts in real time, giving security teams the structured logs they need to file a report within the required window — six hours in Cyprus, 24 hours elsewhere. Deloitte's IT Asset Management survey found that only 29 percent of organizations formally include ITAM in their cybersecurity strategy; a monitoring platform that unifies asset inventory, data lineage, and threat detection closes that gap without a separate integration project.
The competitive dynamic is already visible. A leading AI content-generation platform that relied on a loosely documented web-scraping pipeline faced a provisional €300 million enforcement notice citing gaps in provenance metadata for millions of copyrighted images harvested from public forums. Around the same time, a $1.5 billion settlement in a high-profile copyright dispute hinged on the absence of any disclosed data-source registry — a direct violation of the EU Act's forthcoming requirements. Companies that can reliably certify the legality of their training corpora are beginning to market that assurance as a differentiator, promising customers reduced legal risk and faster time to market for new generative features.
Open-source projects such as Evidently AI's Data Trace and commercial offerings like IBM's Watson Knowledge Catalog have seen a surge in integration projects as they can automatically tag source URLs, embed licensing metadata, and generate immutable audit logs using blockchain-based hash anchoring. These systems also enable dynamic pruning: when a new court ruling reclassifies a set of works as protected, the pipeline can excise the offending subset without retraining from scratch, thanks to modular data shards and incremental fine-tuning techniques that have become standard in 2026.
The engineering overhead is measurable (roughly 15 to 20 percent of capacity), but the alternative is retrospective remediation under regulatory scrutiny. Deloitte's survey reveals that fewer than 40 percent of organizations have fully adapted their ITAM processes to support today's hybrid environments, and shadow IT, weak compliance controls, and fragmented vendor relationships remain pervasive. A monitoring platform that bakes provenance, policy enforcement, and anomaly detection into the inference path turns compliance from a quarterly fire drill into a continuous byproduct of normal operations.
The next wave of standards (ISO 42001, the European Data Provenance Framework, and the EU's forthcoming trust marks for AI systems) will reward demonstrable compliance with preferential procurement status in public contracts. Organizations that embed rigorous data governance practices today will be better equipped to adapt to future mandates without disruptive overhauls. The platform that treats every API call as a compliance event is not just a safety tool; it is becoming the infrastructure that lets enterprises sell into regulated markets at all.
Roadmap: Scaling the Guardrails
The $11 million seed round closes with a clear deployment plan: expand the 20-person team distributed across those European hubs; accelerate product development on the real-time enforcement layer; and grow the customer base across the U.S., U.K., and Europe. That geographic push mirrors where early adoption has already landed (Lovable, plus several fintech and legal companies) and where the platform has already processed more than a billion API requests. The volume itself is a scaling signal: a billion calls means the interception layer is no longer a prototype but a production dependency for customers who cannot tolerate added latency or downtime.
Performance at that scale is the first hard constraint. White Circle sits in the request path between users and models, checking inputs and outputs against company-specific policies in real time. Every millisecond of overhead compounds across billions of calls, and enterprise buyers (especially in fintech and legal) will measure the enforcement layer against their existing API latency budgets. The research arm's KillBench study, which ran that many experiments, doubles as a stress test for the detection engine: the same infrastructure that evaluates model behavior under adversarial prompts must also serve production traffic without becoming a bottleneck. Shilov has said the platform catches hallucinations, data leaks, unauthorized refund promises, and such actions — each detection type a separate policy rule that must evaluate quickly. Scaling the rule engine horizontally while keeping policy evaluation deterministic is an engineering problem distinct from model serving, and the new capital is earmarked for solving it.
Trust is the second challenge, and it is structural. Shilov has argued that model providers have mixed incentives to build the kind of real-time control layer White Circle provides: AI companies still do so, which reduces that incentive. There is also the alignment tax (the observed trade-off where training models to be safer can make them less performant on tasks such as coding) and a plain trust problem: "Why would you trust Anthropic to judge Anthropic's model outputs?" Enterprises deploying models in regulated environments need an independent enforcement point they control, not a safety layer bundled with the model provider's API. White Circle's pitch is that safety will not be solved entirely at the model-training stage; the relevant question is whether a healthcare company, bank, or legal app can control what an AI system does in its own environment. That positioning only holds if the platform itself is auditable, versioned, and transparent about its own false-positive and false-negative rates.
False positives are the third scaling risk, and they are tied directly to the alignment tax. Over-blocking legitimate requests (flagging a valid coding task as malicious, or a routine data query as a leak) erodes developer trust faster than a missed violation. The KillBench results illustrate why this is hard: models made different life-or-death choices depending on attributes such as nationality, religion, body type, or phone brand, and the bias effect worsened when models were forced to output in machine-readable formats — exactly the integration pattern enterprises use to plug AI into products. A policy engine that treats structured outputs as higher-risk must distinguish between "format-induced bias" and genuine policy violations without paralyzing the application. Microsoft's data underscores the urgency: 57 percent of organizations report an increase in security incidents from AI usage, yet 60 percent have not yet started implementing controls. White Circle's mitigation is a policy engine tuned to company-specific rules rather than generic safety categories, but proving low false-positive rates at scale requires customer telemetry the company is only now accumulating.
The agent transition compounds every challenge. As companies move from chatbots to autonomous agents that write code, browse the web, access files, and take actions on a user's behalf, the enforcement surface expands from text-in/text-out to tool calls, file-system operations, and network requests. Shilov has cited examples: a customer-service bot promising an unauthorized refund, a coding agent installing something dangerous on a virtual machine, a fintech model mishandling sensitive customer data. Each agent capability adds a new policy dimension, and a new class of false positives when legitimate automation trips a rule written for a narrower threat model. The roadmap implied by the funding is to extend the interception layer from API gateway to agent runtime, maintaining the same real-time latency budget while covering a wider action space. Microsoft's parallel rollout of Security Copilot agents (including phishing triage, alert triage, vulnerability remediation, and conditional access optimization) shows the industry moving toward agentic security tooling; White Circle's differentiator remains the independent, model-agnostic enforcement point that enterprises can configure without waiting for a model provider's roadmap.
Near-term milestones include hiring across engineering and go-to-market in the three target geographies, shipping the agent-runtime enforcement module, and converting pilot customers in fintech and legal into reference deployments. If the platform can prove it adds safety without adding friction, the trust objection ("why trust a third party?") may flip: enterprises will ask why they would trust a model provider to police its own outputs when an independent layer already processes a billion requests a month with auditable policies. That inversion is the commercial bet behind the roadmap.
The jailbreak that started it all still sits on X, 1.4 million views and counting.
Working in frontier tech? Zero G Talent tracks the openings: see every open OpenAI role, browse frontier tech jobs, openings at Anthropic and DeepMind, and the people building the field.