Security

Security for a gateway that sees every model call

Cloptima sits in your request path, so we design for that. Provider keys are encrypted one secret at a time, prompt content is not stored unless you turn it on, and every request is scoped to the organization in its token.

In the request path

What the gateway holds, and how

The gateway handles your provider keys and your prompts. These are the rules it runs under.

Provider keys

Each stored secret gets its own AES-256-GCM data key, wrapped by a cloud KMS. Every decryption is logged. Provider keys, OAuth tokens, and webhook secrets all go through this path.

Virtual keys

A virtual key is shown once, when you create it. Cloptima keeps only its hash.

Prompt content

Prompt and response content is not stored by default. On Pro and above you can opt in to keep tool inputs and outputs, or full content, for audit. Retained content sits under a per-customer path and is deleted after 95 days.

Tenant isolation

Every request takes its organization from the signed-in session or token. A request body, query, or header can add attribution, but never changes the organization.

Scoped tokens

Personal access tokens for the CLI, MCP, and API carry explicit scopes. An operation without a mapped scope is refused.

Guardrail scans

Cloptima-managed scans send prompt text to one content-safety service in Cloptima's accounts: Azure AI Content Safety, AWS Bedrock Guardrails, Google Model Armor, or Microsoft-Decision-1 on Azure AI Foundry. Connect your own provider accounts to keep scans in yours.

In your network

What runs on your side

Nothing here needs Cloptima to connect into your network.

Edge gateway

Runs in your VPC and reads provider keys from your own secrets, so they never leave your cluster. Policy arrives as an Ed25519-signed snapshot that the edge verifies; the edge holds no signing key.

The platform

How Cloptima runs

Where the service runs, who can sign in, and what is recorded.

Hosting

The gateway and console are hosted in the US West. All traffic to them is encrypted in transit with TLS.

Sign-in

Google, GitHub, or email with verification, brute-force protection, and optional one-time-password MFA. The Enterprise plan adds SCIM user provisioning.

Audit log

Changes to policies, credentials, keys, guardrail bypasses, and cache rules are recorded. Growth and Enterprise plans can export the log.

Data deletion

We delete a customer's data on request, including retained trace content.

Compliance

Process and documentation

Talk to the founders for documentation, or to go through your organization's requirements. To report a suspected vulnerability, email the address below.

[email protected]
  • SOC 2-aligned security controls and processes
  • GDPR-compliant data handling; DPA available on request
  • Data Protection Officer appointed to oversee personal data handling
  • Regular third-party penetration testing and vulnerability scanning
  • Documented incident response with timely customer notification
  • Security overview, sub-processor list, and compliance documentation available under NDA

Put your first governed call through in five minutes

Point your SDK at the gateway, bind a policy, and watch the first call land on the ledger.

Start freeTalk to the founders
No credit card required
5-minute setup
Free plan