Processed in memory. Never stored. Never trained on.
What happens to a prompt after you send it to us, and what your security team can hold us to.
Data handling
Prompt-free logging
Text is checked in memory and discarded. We store the timestamp, violation types, score, latency, and the first 100 characters for debugging.
No training on your data
Inputs and outputs are never used to train, fine-tune, or evaluate any model. The guarantee is written into the Terms of Service.
Encrypted everywhere
TLS 1.3 in transit, AES-256 at rest. API keys are stored as bcrypt hashes, so neither we nor an attacker can read them back.
Never a single point of failure.
A safety layer that can take your product down is not a safety layer.
Fail-open SDKs
Every SDK times out after 300ms and lets the request through. An outage on our side never becomes an outage on yours.
99.9% uptime on paid plans
Endpoints are monitored continuously and we alert on degradation within seconds.
Public status page
Uptime history and incident write-ups for every issue, every time.
Compliance
- GDPR
- Available
- EU data residency available. A Data Processing Agreement is provided on request for all paid plans.
- HIPAA
- Available
- A Business Associate Agreement is available on the Enterprise plan for healthcare and life-sciences workloads.
- SOC 2 Type II
- In progress
- Audit under way. We already operate to SOC 2 controls and will publish the report on completion.
- Data residency
- Available
- US region by default, EU region (Frankfurt) on request. APAC is planned.
Infrastructure
Hosted on Vercel and Supabase
Both providers hold SOC 2 Type II. Altirs inherits their infrastructure security, physical controls, and global edge network.
API key handling
Keys are hashed with bcrypt on creation and shown in plaintext exactly once. Lookup is by prefix, so the full key is never stored.
Rate limiting at the edge
Per-key and per-IP limits enforced through Upstash Redis before a request reaches the checks.
Self-hosted deployment
Run Altirs inside your own network from our Docker image. Data never leaves your infrastructure.
Custom retention and deletion
Set your own log retention. Request full deletion at any time and we purge within 24 hours.
Penetration test reports
Third-party reports shared under NDA. Tests run quarterly.
Have a specific security question?
We will walk through our posture in as much detail as you need.