SECURITY & TRUST

Certification status

We do not claim certifications we do not hold. As of this page's date:

“Aligned” is not “certified.” Aligned means we provide the technical controls the framework requires. Certified would mean an independent auditor said so, and for SOC 2 and ISO 27001 nobody has yet.

What we offer instead of an attestation

An attestation is a trusted third party telling you our controls work. We do not have one yet. What we can offer is the thing an attestation is a proxy for — letting you check yourself:

• Source access under NDA. Read the detection engine, the request path and the data-handling code. Auditors read our answers to a questionnaire; you can read the implementation.
• Dependency transparency and provenance. Our published npm package carries a build-provenance attestation, and self-host licence files are Ed25519-signed and verified offline. A formal SBOM is not yet generated in CI. If your process requires one, say so — we would rather give you a dated commitment than a claim.
• A reproducible zero-egress audit. For self-hosted deployments: run PromptGuard air-gapped, watch the network, and confirm for yourself that nothing leaves. This is a stronger statement than any policy document, because it is not a promise about our behaviour — it is a property of your network.
• Published limits, including the unflattering ones. Our detection numbers ship with confidence intervals, the datasets they came from, and the cases where our own defences measured no effect. Ask any vendor quoting you a detection rate for the same.

To arrange any of these, contact security@promptguard.coCopy.

What happens to your prompt data

We do not train on it

Your prompts, completions and documents are never used to train, fine-tune or evaluate any model, and are never pooled into a shared dataset. Our detectors are trained on public research corpora. There is no code path from your traffic into a training set.

We do not store full prompts

By default a security event records a truncated 500-character preview plus a content hash — enough to identify the threat and to support exact-match lookups, and deliberately not the whole prompt. The reasoning is in the code comment that governs it: full prompts are a liability if the database is breached. A security product must not become the place the secrets it blocks are hoarded.

Zero-retention mode turns off even that

Enable zero-retention per project and no content preview is stored at all — only the decision, the threat classification and the metadata needed for billing and analytics. It is a project setting, so a team can run one high-sensitivity workload under zero-retention without changing anything else.

Content intercepted from browser and desktop surfaces is masked before storage even when zero-retention is off.

Credentials and transport

• API keys and passwords are stored hashed, never in plaintext.
• TLS in transit, with HSTS and a content security policy on every response — including error responses, which is a deliberate middleware-ordering decision rather than a default.
• Deployed secrets live in GCP Secret Manager and are never committed.
• Optional HMAC request and response signing, so you can verify a response came from us and was not altered in transit.

One documented exception, because it is the kind of thing that should not be found rather than told: the free analyzer demo on this marketing site forwards the text you paste to a hosted inference provider. It is a demo, not the product, and our privacy policy spells out that carve-out explicitly.

Deployment models

The strongest data-protection guarantee is architectural: data we never receive cannot be exposed by us. Three supported topologies:

• Cloud. Engine and dashboard hosted by us. Fastest to adopt.
• Hybrid (data plane). The scanning engine runs in your infrastructure; only events and policy sync cross the boundary. Set the forwarding mode to metadata and the control plane receives decisions, counts and threat classifications — no prompt content at all.
• Air-gapped. Engine and a local dashboard, no outbound connections. Licensing is enforced offline with signed Ed25519 licences precisely so an air-gapped install never needs to phone home. Shipped as Docker Compose and a Helm chart.

What air-gapping costs you, stated plainly: the LLM-judge tier and hosted ML inference need a model server. Air-gapped, you either point the engine at a model you serve locally or run without those tiers, in which case detection is the local engine's rules and classifiers only. We would rather you plan for that than discover it.

Hosting and data residency

The hosted service runs on Google Cloud Run in us-central1, with managed Postgres. Frontends are on Vercel.

There is no hosted EU region today. If your data must stay in a specific jurisdiction, the answer is the hybrid or air-gapped deployment above — you choose the region because you choose the infrastructure. We would rather tell you that than imply a region selector we have not built.

Access control and accountability

• Enterprise SSO — SAML and OIDC via WorkOS, with the full authorize and callback flow, not just user import.
• SCIM directory sync — users provisioned, updated and deactivated from your identity provider, so an offboarded employee loses access without a manual step.
• Role-based access control — four roles (owner, admin, member, viewer), enforced server-side. Every resource is scoped to an organization, and organization membership is resolved in exactly one place in the request path rather than re-derived per endpoint.
• Audit logging — authentication, authorization, data access, data modification, configuration and security events, each with actor, outcome and severity. The categories were chosen against SOC 2 criteria CC6.1, CC7.2 and CC8.1 so the log is usable as evidence when the audit does happen.

Your data rights

• Data export and data deletion endpoints, for GDPR and CCPA requests.
• Account deletion removes your data; self-hosted deployments never sent it.
• Compliance evidence packages and exportable reports, for your own audit and governance reporting.
• A DPA covering processor obligations — available on request, alongside the subprocessor list.

Reporting a vulnerability

Report to security@promptguard.coCopy. We acknowledge within 48 hours and aim to ship a fix for critical issues within 7 days. Please include reproduction steps and the impact you believe it has.

We will not pursue legal action for good-faith research that respects user privacy, avoids service degradation and does not access data beyond what is needed to demonstrate the issue.

Machine-readable contact details are published at /.well-known/security.txt.

Engineering practices behind that

• Dependency monitoring across npm, Python and GitHub Actions, with weekly update runs.
• CI must pass before any merge; linting, type checks and the test suite gate it.
• Published claims are themselves gated: automated checks fail the build if a page states a detection figure that contradicts our measurements, or asserts a certification we do not hold. This page is covered by that check.

Reliability

We operate to an internal uptime target of 99.9%. That is a target, not a service-level agreement: there is no standard signed SLA on the self-serve plans, and describing a target as an SLA is exactly the kind of thing this page exists to avoid. Enterprise agreements can include negotiated availability and support commitments — those are contractual terms, agreed in writing, not a number on a pricing page. The platform is monitored with alerting on availability and error rates, and incidents are handled against a written runbook.

Failure behaviour is a design decision worth knowing: the detection engine's fail-open versus fail-closed mode is configurable, so you decide whether a scanner outage blocks your traffic or lets it through. For high-assurance deployments, fail-closed is the correct choice and it is available.

What we do not have yet

We are an early-stage company and this list is the honest version of our roadmap. None of the following exists today:

• SOC 2 Type II attestation — on the roadmap; no audit completed.
• ISO 27001 certification — planned for 2026.
• A signed BAA, and therefore no HIPAA offering for the hosted service.
• FedRAMP authorization.
• A hosted EU or other non-US region.
• A standard signed SLA on self-serve plans (negotiable for enterprise).
• A public status page.
• A formal SBOM (CycloneDX/SPDX) generated in CI.
• An independent third-party penetration test report.

If one of these is a hard requirement for your procurement process, tell us which — it genuinely informs what we prioritise, and we would rather lose an evaluation honestly than win one and be found out at the security review.