What happens to a request, and what we keep.

Prompts are scanned before they leave, not after

Six prompt-injection patterns and eight personal-data and secret patterns run over the messages on the way in, ahead of the call to the provider. A check that runs afterwards tells you what already left.

packages/security/src/detect.ts

Findings are kinds and counts, never the matched text

When the scanner finds a card number, what gets stored is that it found one, of that kind, that many times, in that message. Recording the match would mean a security feature that creates a second copy of exactly the data it exists to notice.

packages/db/prisma/schema.prisma, UsageRecord

No prompt or response body is stored against a request

A usage record carries the model, the token counts, the cost and the timings. It carries no message content, which is why the charge can be recomputed from it and your text cannot.

packages/db/prisma/schema.prisma, UsageRecord

The cache is scoped to your organisation and expires

A cached response is keyed on a SHA-256 of your organisation, the model and the normalised request, and the uniqueness constraint includes the organisation. One organisation cannot read another's cached answer, by construction rather than by a check somebody has to remember. Every entry carries an expiry.

packages/db/prisma/schema.prisma, CacheEntry

Your provider keys are encrypted at rest

A key you bring is stored as AES-GCM ciphertext with its own initialisation vector and authentication tag, never as text in a column.

packages/db/prisma/schema.prisma, ProviderKey

Spend caps refuse the request, they do not report on it

Both the per-key cap and the organisation limit are checked before a provider is called, and a request over the line comes back 402 rather than succeeding and appearing on a report.

apps/gateway-api/src/billing

Sessions are revocable, individually and all at once

Every token carries an identifier that maps to a session row, and both guards check it on every request. Signing out everywhere takes effect immediately rather than waiting for a token to expire.

packages/auth

Single sign-on, per organisation

An organisation can connect its own identity provider, so joining and leaving is handled where your other software already handles it.

packages/db/prisma/schema.prisma, OrgSsoConnection

No SOC 2, and no penetration test report

Neither exists yet. Both are money and elapsed time rather than engineering, and claiming either before it is true is the one thing on this page that could not be walked back.

The scanners are heuristics, and the default is to flag

They are regular expressions over the messages, not a model, and they will miss things a determined author can phrase around. Every organisation starts in flag mode, where nothing is ever refused. Block mode is one header or one setting away, and it is off until you choose it.

Caching is off unless you ask for it

A response is only cached when the request carries the cache header, so nothing is stored on your behalf by default.

Your prompt still reaches the provider you chose

Vatan sits in front of the model providers; it does not replace them. What we can do is tell you what left, refuse what should not, and never keep a copy ourselves.