Oberik

What it is

Oberik is an agent infrastructure layer designed for SaaS platforms. It enables companies to add AI capabilities to their products without building core infrastructure from scratch. The platform provides retrieval-augmented generation with document citations (page and quote level), sandboxed Linux environments for agents to execute code and commands, persistent memory across sessions, and scheduled work that survives application restarts.

The platform prioritizes multi-tenancy and security, offering hard isolation between customers through project-based tenancy, capability-scoped tokens, and server-side permission enforcement. It supports bring-your-own-key integrations with major LLM providers including OpenAI, Anthropic, Google, AWS Bedrock, Azure, Mistral, and others. Cost tracking is per-customer and per-request, allowing transparent billing of AI usage back to end users.

Integration is designed to be lightweight, requiring only two API calls: one to mint a scoped token on the backend and one to stream answers in the frontend. The platform includes comprehensive guardrails for prompt injection and PII screening, and can be configured via an SSH interface for programmatic setup.

Quick answers

What does it actually cost?

Nothing while Oberik is launching. Model usage is billed by your LLM provider on your own account at their standard rates; Oberik does not markup or resell tokens. Notice will be given before any changes to this pricing.

Which models can I use?

Effectively all major models: OpenAI, Anthropic, Google, Bedrock, Azure, Mistral, Groq, DeepSeek, OpenRouter, or self-hosted options like Ollama or vLLM. Model selection is a project setting and can be swapped with a dropdown change, not requiring code deployment. Each project can also select its own embedding, reranking, and OCR models.

How are my customers kept apart?

Each project is its own tenant with separate documents, embeddings, files, sandboxes, credentials and spend tracking. Every request carries a short-lived token that determines the tenant; the API never takes tenant identity from request bodies. Within a project, hierarchical scopes such as 'acme:finance:ana' further restrict which data individual end-users can access.

Can the model give itself more permissions?

No. Capabilities are set as a project ceiling in the dashboard, intersected again when a token is minted, and checked once more per request. Tokens can only be narrower than their maximum, never wider, so tools the model attempts to call without the required capability are refused before execution.

Do I have to rewrite my product?

No. Integration requires only two calls: your backend mints a token for the signed-in user, and your frontend streams the answer. Your existing UI, authentication system, and data model remain unchanged—Oberik sits as a layer underneath.