Audit-ready by construction.
Every request — success, failure, blocked, denied — produces exactly one HMAC-SHA256 signed event row. You don't assemble an audit trail for the regulator. You already have one.
Denied requests are never invisible.
One request, one denormalized row — signed with HMAC-SHA256, verified on read. That includes the requests that didn't happen: every 401, 402, 403, 429, 400, and every admin mutation. If someone tried something your policy forbids, the attempt is in the log with its reason.
- Tamper-evident — signatures verified on read; a mutated row fails verification
- Weekly partitions — built for retention at scale
- Request IDs end-to-end — X-Request-Id from client to upstream to event row
- SIEM-ready export — JSON, JSONL, or Syslog RFC 5424
You can prove what was captured — and why.
Every event carries a capture provenance stamp: which policy won, which toggles were on, and the exact skip reason when a wanted body wasn't stored. Your audit answers hold up because the log explains itself.
Baseline capture — always on
Redacted request headers and error response bodies (status ≥ 400) are captured on every request, no policy required. Debugging and incident review never depend on someone having turned logging on first.
Full capture — policy-gated
Prompt and response bodies capture only when a request_body_logging policy says so — with independent capture_prompt / capture_response toggles, scoped from global down to a single virtual key. Sensitive teams stay out of the log by default.
"EU team → EU-hosted models only" is one allowlist.
Model allowlists are enforced pre-upstream with most-specific-scope-wins intersection semantics, matching both aliases and upstream model IDs — with explicit deny-all support. A request for a non-approved model never leaves the gateway, and the blocked attempt is in your signed log.
Marketing · allowlist: all models
Low-sensitivity work — copy drafts, ideation, public content. Reaches every model in the catalog, including Kimi 3 and DeepSeek in untrusted regions. Every call still budgeted and signed into the event log.
Engineering · trusted providers only
Source code and internal docs stay on trusted providers. A call to an untrusted-region model is denied at the gateway — 403 model_not_allowed — before a single token leaves.
EU Finance · EU-region only
Regulated data stays in-region by policy: EU Finance reaches only EU-hosted models. Denied calls cost nothing — and still write exactly one HMAC-signed event row to the audit log.
Intersection semantics
Policies at global, org, department, user, and key scope intersect — the most specific scope wins. Tighten a team without touching the org.
Regional data residency
Deployed in AU, APAC, EMEA, UK, and Germany — all live. Your inference runs in the region you choose, by construction, supporting GDPR, UK DPA, and the Australian APPs.
Absolute tenant isolation
Cross-organization data access is structurally impossible — every read is scoped by the active customer, and cross-org resource access returns 404. Even read-only, even for platform admins.
Your IdP is the source of truth.
OIDC BFF integration with Okta, Entra, Keycloak, Zitadel, or Google Workspace. Server-side sessions — no client-side tokens. Strict RS256 / issuer / audience / nonce validation with PKCE. Team memberships recompute from your IdP roles claim on every login; orphaned keys are suspended automatically. No master-key escape hatch exists.
The security model →SOC 2 Type II
Audited controls over security, availability, and confidentiality — report available under NDA at Enterprise.
ISO 27001
Certified information security management system covering the platform and its operations.
HIPAA
Controls aligned for healthcare workloads; DPA and sub-processor review available at Enterprise.