Every layer secured. Every event auditable.
Encryption at rest and in transit, tamper-evident audit chains, a multi-layer content inspection pipeline, 12 compliance frameworks, and 7 SIEM connectors — built into the architecture, not bolted on.
Data protected at rest and in transit.
No unencrypted paths exist in the architecture. Data at rest is protected with AES encryption. Data in transit is protected by TLS 1.3 minimum with HSTS enforced across all endpoints.
Encryption at Rest
| Algorithm | AES encryption with HMAC-SHA256 authentication |
| Key scope | Per-tenant dedicated encryption keys |
| Coverage | Audit records, DLP detection results, conversation metadata, SIEM connector credentials |
| Key rotation | Supported — OAuth secret rotation for service credentials |
Encryption in Transit
| Protocol | TLS 1.3 minimum for all connections |
| HSTS | Enforced — no unencrypted HTTP paths |
| mTLS | Available for Hybrid Outpost data plane connections |
| Certificate validation | Full chain — leaf, intermediate CAs, and root CA verified end-to-end |
HMAC-SHA256 chained audit logs.
Every event in the audit log is cryptographically linked to the previous event using HMAC-SHA256. This creates a tamper-evident chain — any modification, insertion, or deletion of an audit record breaks the chain and is detectable.
Chain Integrity
Each audit record includes an HMAC digest computed over the current event data and the previous record's digest. Tamper detection is automatic — break one link, break the chain.
Tenant Scoping
Audit chains are per-tenant. No cross-tenant log aggregation or commingling. Compliance exports, SIEM delivery, and governance dashboards reflect only the requesting tenant's data.
GeoIP Enrichment
Source and destination IP addresses are included in the HMAC chain. GeoIP enrichment fields — country, region, city, ISP, ASN — are captured at event time, never retroactively applied.
Credential Intelligence
Credential intelligence results — hit status and detection metadata — are captured alongside audit events. Compromised credentials checked against a dataset via real-time in-process lookup.
Multi-layer content inspection pipeline.
Every AI request is inspected at all tiers before reaching the model provider. The pipeline detects PII, regulated data, credentials, and compliance-sensitive content — then enforces block, redact, or log actions on both input and output.
Pattern Detection
80+ regex pattern detectors with checksum validators for structured data — credit card numbers, SSNs, IBANs, routing numbers, and more. Sub-millisecond execution, zero false negatives on validated formats.
Named Entity Recognition
40 entity recognizers powered by AI-based contextual detection with local inference. Detects unstructured PII — names, addresses, medical record numbers, financial identifiers — that patterns alone cannot catch.
Contextual Validation
An AI-powered contextual validation model validates detections in context — distinguishing real PII from false positives by analyzing surrounding text. Reduces noise without sacrificing recall.
12 regulatory compliance frameworks.
Pre-built compliance bundles map DLP detection rules to regulatory requirements. Three frameworks — PCI-DSS, HIPAA, and GDPR — include inline pattern rules that cannot be suppressed at the organization level.
PCI-DSS
Payment card industry — credit card numbers, PANs, track data, CVVs. Inline rules enforced.
HIPAA
Protected health information — patient names, MRNs, diagnoses, treatment records. Inline rules enforced.
GDPR
EU personal data — names, addresses, national IDs, financial identifiers. Inline rules enforced.
GLBA
Financial privacy — customer financial records, account numbers, transaction data.
SOX
Financial reporting controls — audit trail integrity, access controls, data retention.
BSA/AML
Anti-money laundering — suspicious activity patterns, customer identification, transaction monitoring.
CCPA
California consumer privacy — personal information categories, opt-out rights, data inventory.
SEC Reg FD
Broker-dealer record retention — immutable storage, audit trail preservation, regulatory hold.
7 enterprise SIEM connectors.
Audit events route to your existing security operations toolchain. Per-tenant SIEM configuration with encrypted connector credentials. Each connector delivers events via the platform's native protocol.
| SIEM Platform | Protocol | Status |
|---|---|---|
| Splunk | HEC REST API | Functional |
| Microsoft Sentinel | Data Collection Rules API | Functional |
| Elastic SIEM | Elasticsearch Bulk API | Functional |
| Datadog | Logs Intake API v2 | Functional |
| Sumo Logic | HTTP Source | Functional |
| IBM QRadar | CEF over TLS syslog (RFC 5424) | Functional |
| Cortex XSIAM | HEC REST API with XSIAM envelope | Functional |
Per-tenant SIEM delivery — audit events route to the tenant's own SIEM endpoint, not a shared collector. Connector credentials encrypted at rest.
Hardened against OWASP Top 10:2025.
The platform is hardened against all categories in the OWASP Top 10:2025. Every API surface enforces CSRF protection, JWT algorithm restrictions, SSRF prevention, and tenant-scoped access controls.
OWASP Compliance
Injection prevention, broken authentication controls, access control enforcement, security misconfiguration remediation, and server-side request forgery protection — all addressed and tested.
JWT & Auth Hardening
JWT algorithm allowlist enforcement, CSRF middleware on all state-changing requests, compromised-credential checking on registration and password reset, and admin-controlled registration gates.
Tenant Isolation
Admin operations, configuration backups, policy templates, and SCIM provisioning are strictly tenant-scoped. Webhook URLs are re-validated on every request to prevent DNS rebinding attacks.
Container Security
Production containers run with read-only filesystems, dropped Linux capabilities, and explicit build directives — reducing the attack surface for container escape and privilege escalation.
Evaluate our security architecture.
Request a technical deep-dive with our security team — encryption, audit chain verification, content inspection pipeline walkthrough, and compliance framework mapping.