Built to pass the review.
This is the page your security team reads before approving us: every control a review checks for, and exactly where we stand on each. Shipped, an enterprise engagement, or on the roadmap. Nothing here claims a certification, scan, or integration we don’t have.
Open source, end to end
Every release in the open. Read the code your traffic flows through.
Keys stay at the gateway
People and agents hold scoped gateway keys. Provider keys never reach them.
Policy on every request
Where a request may go is enforced in the routing, not by convention.
SOC 1
The certification we hold today, and the only one we claim.
The security controls a review will check for.
Each one labeled honestly. Where we stand is verified against the code, not the roadmap deck.
- 01
Supply chain
On the roadmapA review asks: Signed, hardened, non-root images with verifiable provenance before deploy.
Installs are pinned end to end today: a locked dependency graph, releases cut from CI, and a build path you can audit line by line in the open repo. Signed images and published provenance are on the roadmap.
- 02
Scanning
On the roadmapA review asks: Vulnerability scanning on images and static analysis on the codebase, with clean highs and criticals.
Every pull request and every push passes a full gate today: lint, strict type checks, and the complete non-live test suite. Dedicated vulnerability scanning with published results is on the roadmap, and the codebase is open to any scanner you already run.
- 03
Identity
ShippedA review asks: SSO through your identity provider, role-based access, SCIM provisioning.
Sign-in with Google or GitHub ships today, and every organization carries four roles (owner, admin, member, viewer) enforced at the data layer. SAML and OIDC SSO and SCIM provisioning are enterprise engagements: contact us.
- 04
Guardrails
Contact usA review asks: PII masking and prompt-injection defenses in the request path.
Not shipped today, and we won't pretend otherwise. The gateway's single request path is the natural mount point for them; we scope guardrail integrations as part of an enterprise engagement.
- 05
Secrets
ShippedA review asks: Credentials pulled from a managed secret store, never hardcoded, never in agent context.
Provider keys are stored encrypted in a managed vault and attached to requests at the gateway, so people and agents only ever hold scoped gateway keys. Integrations with AWS Secrets Manager, HashiCorp Vault, and Azure Key Vault are enterprise engagements.
- 06
Residency
ShippedA review asks: A self-hosted mode where data never leaves your infrastructure.
The gateway is open source and runs on your own infrastructure with one command. Prompts and completions never leave your deployment. The only outbound signal is anonymous usage telemetry that carries no request content and turns off with one environment variable.
Every release in the open.
Security teams don’t have to take our word for anything on this page. The gateway your traffic flows through is public, commit by commit: read it, point your own scanners at it, or run it yourself.
uvx --from experiential exp runWhere your data may go is policy.
Set once at the gateway, enforced on every request your whole team sends.
Zero Data Retention routing
Route only to providers under ZDR agreements. Set per request or team-wide, enforced at the gateway.
No training on your data
Route only to providers that will not train on customer data, configurable per request.
Provider allowlist
Restrict your team to approved providers. Enforced on every request, with no code changes.
Full attribution
Every request logged: who sent it, which model answered, which provider served it, and what it cost.
uvx --from experiential exp runself-host in one commandFound a vulnerability?
Report it privately through GitHub security advisories on the open repo. We read them fast, and good-faith research is welcome.
Bring your security review.
Walk us through your checklist on a call, and read the code before you do.