Built so nobody has to be trusted
with your data. Including us.

Architecture

• The gateway runs on each developer machine on loopback, as the user, without root.
• It connects only to the AI providers you use, your console if the machine joined one, and feed URLs your administrators configure.
• Fails closed: content it cannot inspect is refused; a gateway that cannot write its audit log refuses requests.
• A credential for one provider is never forwarded to another.

Cryptography and keys

• Tokens: AES-SIV, authenticated, bound to deployment, principal and session; they cannot be forged or replayed across conversations.
• Keys are generated from the operating system's random source and stored readable only by the user.
• No vault: no service or database maps tokens to values.
• Gateway token keys can be wrapped under a key in the OS keychain, AWS KMS, Google Cloud KMS or your own program (Vault, an HSM’s tool); not yet: a native HSM integration, or wrapping of the audit log’s signing key.

What the console sees

Receives: versions, health, self-test results, routed client ids, daily counts by data category and outcome, model names with token counts and estimated spend per model, budget states, latency percentiles, the audit chain's head hash, and the accounts of the people who sign in to it.

Never receives: prompts, responses, files, protected values, tokens, keys, file paths, your organisation's salt.

Your rules are stored as keyed digests and signed on your administrator's machine; every gateway verifies the signature, so nobody, us included, can change what your gateways enforce.

Isolation and storage

• PostgreSQL row-level security per organisation, checked by an isolation test against the live service on every release.
• Secrets the service must reuse (MFA seeds, webhook and SSO client secrets) are encrypted at rest under a key held outside the database.
• Backups every six hours: restore-tested, encrypted to an offline key, copied off-site with a 30-day deletion lock.
• Statement and lock timeouts; the service answers 503 quickly during a database outage instead of hanging.

Identity and access

• SSO with OpenID Connect (Entra ID, Okta, Google, Auth0, Keycloak, Authentik), SCIM 2.0, MFA with one-time codes that work once.
• Roles: owner, admin, approver, analyst, auditor, viewer; scoped, expiring API keys for automation.
• Two-person approval for access and policy changes; sessions of 12 hours with an idle timeout; IP allow lists.

Vendor access

Our operators see your plan, seats and licence and the same content-free figures as your dashboards. Every operator view or action on your organisation is written to your audit trail and webhooks, and you decide whether operators may open usage detail without your time-boxed grant.

Limits we publish

Detection doesn't find every sensitive meaning. Routing is not a sandbox. Web AI apps and tools without a configurable endpoint aren't routed. Windows is in preview.

Report a vulnerability

See security.txt. Please allow 90 days before public disclosure; we credit reporters who want it.