SECURITY & TRUST

Certification status

We do not claim certifications we do not hold. As of this page's date:

“Aligned” is not “certified.” Aligned means we provide the technical controls the framework requires. Certified would mean an independent auditor said so, and for SOC 2 and ISO 27001 nobody has yet.

What we offer instead of an attestation

An attestation is a trusted third party telling you our controls work. We do not have one yet. What we can offer is the thing an attestation is a proxy for, letting you check yourself:

• Source access under NDA. Read the detection engine, the request path and the data-handling code. Auditors read our answers to a questionnaire; you can read the implementation.
• Dependency transparency and provenance. Our published npm package carries a build-provenance attestation, and self-host licence files are Ed25519-signed and verified offline. Every desktop agent release ships a CycloneDX SBOM of its Rust dependencies, with SHA-256 checksums and a build-provenance attestation. The hosted platform has no SBOM yet. If your process requires one, say so, we would rather give you a dated commitment than a claim.
• A reproducible air-gap egress audit. For Air-gapped deployments: run PromptGuard behind its default-deny egress NetworkPolicy, watch the network, and confirm for yourself that nothing leaves. This is a stronger statement than any policy document, because it is not a promise about our behaviour, it is a property of your network.
• Published limits, including the unflattering ones. Our detection numbers ship with confidence intervals, the datasets they came from, and the cases where our own defences measured no effect. Ask any vendor quoting you a detection rate for the same.

To arrange any of these, contact security@promptguard.coCopy.

What happens to your prompt data

We do not train on it

Your prompts, completions and documents are never used to train, fine-tune or evaluate any model, and are never pooled into a shared dataset. Our detectors are trained on public research corpora. There is no code path from your traffic into a training set.

We do not store full prompts

By default a security event records a truncated 500-character preview plus a content hash , enough to identify the threat and to support exact-match lookups, and deliberately not the whole prompt. The reasoning is in the code comment that governs it: full prompts are a liability if the database is breached. A security product must not become the place the secrets it blocks are hoarded.

Zero-retention mode turns off even that

Enable zero-retention per project and no content preview is stored at all, only the decision, the threat classification and the metadata needed for billing and analytics. It is a project setting, so a team can run one high-sensitivity workload under zero-retention without changing anything else.

Content intercepted from browser and desktop surfaces is masked before storage even when zero-retention is off.

Credentials and transport

• API keys and passwords are stored hashed, never in plaintext.
• TLS in transit, with HSTS and a content security policy on every response, including error responses, which is a deliberate middleware-ordering decision rather than a default.
• Deployed secrets live in GCP Secret Manager and are never committed.
• Optional HMAC request and response signing, so you can verify a response came from us and was not altered in transit.

One documented exception, because it is the kind of thing that should not be found rather than told: the free analyzer demo on this marketing site forwards the text you paste to a hosted inference provider. It is a demo, not the product, and our privacy policy spells out that carve-out explicitly.

Deployment models

The strongest data-protection guarantee is architectural: data we never receive cannot be exposed by us. Three supported topologies:

• Cloud. Engine and dashboard hosted by us. Fastest to adopt.
• Hybrid (data plane). The scanning engine runs in your infrastructure; only events and policy sync cross the boundary. Set the forwarding mode to metadata and the control plane receives decisions, counts and threat classifications - no prompt content at all.
• Air-gapped. Engine and a local dashboard, with outbound traffic denied at the network layer (the Helm chart's NetworkPolicy, or your firewall). Licensing is enforced offline with signed Ed25519 licences precisely so an air-gapped install never needs to phone home. Engine, dashboard and schema migrations all ship in both Docker Compose and the Helm chart, installed from a signed offline image bundle against your own PostgreSQL and Redis.

What air-gapping costs you, stated plainly: the LLM-judge tier needs a model server you run on a GPU, and it is not one we validate for you. The ML classifiers do not, they run in-process on CPU, on ONNX weights you fetch once on a connected machine with your own Hugging Face token, because we do not redistribute them. Run without the judges and every scan lists them as unavailable checks rather than counting them as passes. We would rather you plan for that than discover it.

Hosting and data residency

The hosted service runs on Google Cloud Run in us-east4, with managed Postgres. Frontends are on Vercel.

There is no hosted EU region today. If your data must stay in a specific jurisdiction, the answer is the hybrid or air-gapped deployment above, you choose the region because you choose the infrastructure. We would rather tell you that than imply a region selector we have not built.

Access control and accountability

• Enterprise SSO, on the hosted service, OpenID Connect with your identity provider, which we set up with you. SAML and OIDC via WorkOS are available on self-hosted installs; the hosted service does not offer SAML yet.
• Role-based access control, four roles (owner, admin, member, viewer), enforced server-side. Every resource is scoped to an organization, and organization membership is resolved in exactly one place in the request path rather than re-derived per endpoint.
• Audit logging, authentication, authorization, data access, data modification, configuration and security events, each with actor, outcome and severity. The categories were chosen against SOC 2 criteria CC6.1, CC7.2 and CC8.1 so the log is usable as evidence when the audit does happen.

Your data rights

• Data export and data deletion endpoints, for GDPR and CCPA requests.
• Account deletion removes your data; self-hosted deployments never sent it.
• Compliance evidence packages and exportable reports, for your own audit and governance reporting.
• A DPA covering processor obligations - available on request, alongside the subprocessor list.

Reliability

We operate to an internal uptime target of 99.9%. That is a target, not a service-level agreement: there is no standard signed SLA on the self-serve plans, and describing a target as an SLA is exactly the kind of thing this page exists to avoid. No plan includes an uptime commitment: one exists only if it is written into an agreement you sign with us, never as a number on a pricing page. The platform is monitored with alerting on availability and error rates, and incidents are handled against a written runbook.

Support is by email, at support@promptguard.coCopy. Plans that include priority support (see pricing) get a response within 24 hours; on the others we answer as soon as we can, with no committed response time. A faster response, like an uptime commitment, exists only if it is written into an agreement you sign.

Failure behaviour is a design decision worth knowing: the detection engine's fail-open versus fail-closed mode is configurable, so you decide whether a scanner outage blocks your traffic or lets it through. For high-assurance deployments, fail-closed is the correct choice and it is available.

What we do not have yet

We are an early-stage company. None of the following exists today:

• SOC 2 Type II attestation, not started; no audit is scheduled.
• ISO 27001 certification, not started; no audit is scheduled.
• A signed BAA, and therefore no HIPAA offering for the hosted service.
• FedRAMP authorization.
• A hosted EU or other non-US region.
• An uptime commitment on any plan: one exists only if it is written into an agreement you sign.
• An SBOM for the hosted platform (the desktop agent ships one).
• An independent third-party penetration test report.
• A paid bug bounty programme.

If one of these is a hard requirement for your procurement process, tell us which, it genuinely informs what we prioritise, and we would rather lose an evaluation honestly than win one and be found out at the security review.