What We're Working On

Arbitex runs a public coordinated disclosure program. Researchers who find a vulnerability have a clear way to reach us, a written safe-harbor commitment, PGP-encrypted reporting, response SLAs measured in business days, and public credit if they want it. security.txt is live at /.well-known/security.txt; the full policy, scope, and rules of engagement are at /security/policy; published acknowledgments live at /security/acknowledgments.

Your users do not always know what is sensitive. They paste documents, transcribe calls, and fill in forms — and some of that content should never reach an AI model. The 3-tier DLP pipeline reads every request before it goes out, detects sensitive content, and applies the configured policy action — redact or block — before the request reaches any model. The result: zero sensitive data reaching a model that should not see it.

Arbitex undergoes independent multi-model adversarial security review across its entire codebase. Findings are triaged by severity and remediated before release — attack chains identified and closed, audit chain integrity hardened, fail-closed enforcement applied across every DLP tier, and container security standardized.

DLP detects structured entities — credit card numbers, SSNs, API keys, PHI. Content Categories add the missing governance dimension: topic. A prompt can contain no sensitive entities and still violate acceptable use policy because of its subject matter — investment advice from a non-finance user, offensive security research from an unvetted account. The content classification layer evaluates incoming prompts against 8 content domains and 26 sub-categories before the policy engine runs, populating category matches as first-class policy conditions alongside entity types and user groups.

When a customer uploads a file to Google Drive, OneDrive, Box, or an S3-compatible destination through a passthrough path, the platform inspects it first. Every file goes through the same 3-tier DLP pipeline that protects AI traffic and email before it is forwarded to the destination. Flagged files go to the unified quarantine — the same inbox that handles email and AI findings — where admins can release, reject, or manually re-scan. One quarantine, every channel.

Most teams use more than one AI provider. Most security teams have opinions about which providers are approved for which uses. Arbitex Gateway connects to 9+ AI providers and enforces your rules on every call. You set the policy for who can use what — the gateway handles the rest, with automatic failover when a provider has an outage and Compare mode for evaluating models side by side.

When a regulator or an internal auditor asks what happened to your AI traffic, the answer is immediate and complete. The audit log captures every request, every policy decision, and every compliance framework event that satisfies it. The record is tamper-evident: once written, it cannot be changed.

Every channel — AI gateway, email relay, file uploads, and cloud storage passthrough — needs to extract content from files and scan it for sensitive data. Instead of duplicating that logic per product, the platform uses a shared inspection engine. It handles text extraction from documents, GPU-accelerated OCR for images and scanned PDFs, and runs the full DLP pipeline — all in a single in-process call with no extra network hops. Adding a new file format means adding one handler. Every channel benefits immediately.

A governance policy is only useful if it does what you intended. The policy engine lets security teams write policies in plain conditions and test those policies against real traffic before they go live. You can see exactly what a rule would do — and adjust before anything breaks.

Some organizations cannot send AI traffic through a third-party cloud service. Hybrid Outpost deployment puts the part of the platform that touches your data — inspection and logging — inside your own infrastructure. The management interface and dashboards remain hosted services. Your AI traffic never leaves your network.

Enterprises run dozens of internal apps and integrations that call AI services. Customer App Registry lets teams register each application as a named client identity — with its own API key, per-client DLP policy, rate limits, audit trail, and usage dashboard. Developers get a self-service portal with a sandbox environment to test configurations before they reach production. The platform stops treating all traffic as anonymous and starts answering the question that actually matters: which app sent this?