Security & trust
How we protect your data, secure your infrastructure, and ensure compliance at the gateway level.
Spineforge sits at the critical intersection of your internal infrastructure and external LLMs. We operate on a strict zero-trust architecture designed to protect your proprietary data, prevent unauthorized access, and ensure absolute privacy. Here is how your data remains fully secure.
Spineforge acts as a secure transit and observability layer. We do not use your prompts, responses, or telemetry data to train any AI models. Furthermore, by routing through Spineforge, you inherit our enterprise agreements with major LLM providers, ensuring your data is opted out of their training pipelines by default.
All data flowing through the Spineforge gateway is secured using industry-standard encryption protocols. Data in transit is encrypted via TLS 1.2+, and any telemetry or audit logs stored within our infrastructure are encrypted at rest using AES-256.
You own your audit logs. We offer granular data retention policies tailored to your compliance needs. Enterprises can configure “Zero-Retention Mode” where Spineforge processes the payload for real-time security scanning (PII masking, prompt injection defense) and drops it immediately, acting purely as a secure passthrough.
Spineforge integrates directly with your existing enterprise identity providers (Okta, Azure AD, Google Workspace) via SAML/SSO. Role-Based Access Control (RBAC) ensures that only authorized security and engineering personnel can view audit logs, adjust rate limits, or revoke agent API keys.
Your master LLM API keys (OpenAI, Anthropic, etc.) are heavily encrypted and stored in isolated, highly secure key vaults. Individual AI agents and internal developers are only issued Spineforge sub-keys, meaning your root LLM credentials are never exposed in local environments, IDEs, or client-side code.
Our infrastructure is actively aligned with global security and privacy standards, including SOC 2, GDPR, and the EU AI Act. Spineforge provides the continuous audit trails your compliance teams need to prove that AI data governance is actively enforced across your organization.
You choose what we store
Match the gateway to your risk profile, from storing nothing to full audit replay. In progress
Spineforge records who called what, when, how much it cost and how it went, never the content. The strictest option for sensitive workloads.
Where we're heading
We're building toward stronger isolation and certification. We publish what's in progress honestly, and prioritise with our first enterprise customers.
The security framework that proves how we protect customer data, audited first at a point in time (Type I), then continuously over a period (Type II).
A separate Spineforge instance and database per customer in the cloud, for complete workload and data isolation.
Run the gateway inside your own infrastructure. We ship signed container images or binaries under a commercial license, no source code required.
Added controls for extra security
Remove stored prompts, responses and logs whenever you need to.
Scope who can view logs, change limits and revoke agent keys.
Our team will walk your security and compliance teams through the architecture and answer every question.