Trust/Security

A control plane sees everything. This page is how little of it we keep.

Putting a control layer in front of your model traffic means your prompts pass through us, and the redacted version of them is kept. That is a serious thing to ask of a security team, so the answers are here in full: where traffic is processed, what is written to disk, for how long, who inside your organisation can see it, and what happens when a component fails.

Get the Trust Center documents Follow one request
EU only
Processing and storage regions
Redacted only
What reaches storage, unless you accept the risk
Fail closed
Default when a control is unavailable, set per project
99.95%
Contractual availability, Enterprise
On this page
Data flow Regions Encryption Prompt handling Raw-content retention Audit retention SSO and MFA Access roles Subprocessors Fail closed Availability Secure development
01 Data flow

Where your request goes, stage by stage

One TLS connection from your application to obstruo, one from obstruo to the provider. Between them, six stages run in memory. The only things that reach persistent storage are marked below.

Outbound path, application to provider ~20ms added, p50
Your application
Holds one obstruo key. Provider keys never leave our vault.
TLS 1.3
Authenticate and admit
Key, project and agent identity resolved. Unregistered callers stop here.
in memory
Classify and redact
Jurisdiction policy applied, entities tokenized, mapping held for the life of the request.
in memory
Route and send
Provider chosen by rule, provider key attached inside our boundary.
TLS 1.3
Return path, provider to application
Inspect the response
Output policy applied to what the model sends back, including tool results.
Re-identify
Tokens swapped back to real values inside your boundary, then the mapping is discarded.
Write the record
Decision, policy version, counts, routing, and the redacted prompt and response.
persisted
Persisted: metadata record, redacted prompt and response, configuration, provider keys
Transient: raw prompt and completion, token mapping, raw tool arguments
Never: training on your traffic, of any kind, on any plan
Managed control plane

Runs in our EU tenancy. The diagram above is the whole path.

Private deployment

Same control plane in your own cloud account. Traffic never crosses our network, control plane stays managed.

Air-gapped control plane

Configuration and audit stay inside your estate. Available on Enterprise, scoped per deployment.

02 Processing and storage regions

Pinned regions, and the ability to refuse anything outside them

Residency claims are worth little if the enforcement is advisory. Each project is pinned to a hosting region for processing and storage, and France is the region available today. The boundary that policy enforces is the EU one: a route that would send traffic to a provider endpoint outside the EU is refused in path, not logged as a warning after the fact. Traffic between EU member states is normal and stays allowed. If a regulator requires a single member state, you can pin the project tighter than the EU. We open further regions when a customer needs one, on a timeline we agree in the contract.

Company registered in the EU, infrastructure in EU regions only
Storage stays in the project hosting region, including backups
Support access from outside the EU requires a named approval with an expiry
Region mapJuly 2026
REGIONSERVESSTATUS
eu-west-3Paris, FranceAvailable
eu-central-2WarsawPlanned
eu-north-1StockholmPlanned
ch-north-1ZurichPlanned
non-EU endpointsAny providerRefused by policy
PLANNED REGIONS OPEN ON DEMAND, TYPICALLY IN WEEKS, NOT QUARTERS
Tell us which jurisdiction you need pinned and we will confirm a date before you sign.
TRANSFER BASIS, WHEN A PROJECT PERMITS ONE
For transfers out of the EU only: standard contractual clauses, recorded per provider, with the approving role and date on the record. Nothing is enabled by default.
Cryptography in use
In transit, edge and upstreamTLS 1.3, 1.2 floor
Service to service, internalmTLS, short-lived certs
At rest, all stores and backupsAES-256-GCM
Provider keys, field levelEnvelope, per tenant DEK
Key derivationPBKDF2-HMAC-SHA256
Secret and credential hashingArgon2id
Audit chain sealsTransit HMAC-SHA256
Key custodyHSM-backed KMS, EU
Key rotationAnnual, or on demand
Customer-managed keysEnterprise, BYOK
WHAT A STORED PROVIDER KEY LOOKS LIKE TO AN OPERATOR
sk-••••••••••••••••••••••••4f19 last 4 shown, never the whole value
03 Encryption

Standard cryptography, unusual care around the keys

The transport and storage encryption is what you would expect and would be unremarkable to specify. The part worth reading closely is key custody: obstruo holds your provider credentials, so they are encrypted per tenant with keys we cannot export, decrypted only in the request path, and never rendered in full to any interface, export or support session.

No read path for a provider key, for any role or any employee
Rotation and revocation from the console, without a deploy
Every key use is attributable to a project, an agent and a request
04 Prompt and response handling

Raw content lives in memory. Only the redacted version is kept

The prompt as your application sent it exists in memory for the duration of one request, and is released when the response completes. What is written to storage is the post-redaction text, with detected entities already replaced by tokens, so the stored copy is the one your policy considers safe to hold. Teams that would rather hold nothing at all can switch content storage off per project, and teams that genuinely need the original content have to ask for a raw-audit project and accept the risk in writing.

Unredacted content never reaches logs, crash dumps or error reports
Token mappings are per request and discarded on completion
Your traffic is never used to train, tune or evaluate any model, ours or a provider's
Lifetime of one requestreq_8f31c04a
Prompt receivedt+0ms
3 entities tokenizedt+18ms
Forwarded to the approved provider in regiont+21ms
Response re-identified and returnedt+1.4s
Raw content and mapping released, redacted copy storedt+1.4s
WHAT SURVIVES THE REQUEST
{ decision, policy_version, categories[3], counts, provider, region, latency,
  prompt: "claim for <PERSON_1>, IBAN <ACCOUNT_1>…" }
05 Raw-content retention

Redacted by default, nothing at all if you prefer

Storing the redacted prompt is what makes an agent debuggable months later without holding personal data. Storing the raw prompt is what most gateways quietly do. Here it is neither quiet nor accidental: a project has to be created as a raw-audit project, with a reason and a signed acceptance of the risk.

DefaultACTIVE
Redacted text

Prompts, completions and tool payloads are stored after redaction, with detected entities already replaced by tokens. Raw content is never written.

Content storage offPOLICY
0 bytes

Set per project, redacted content is discarded with the request and only the decision record remains. Enforcement and audit are unaffected.

Raw-audit projectRISK ACCEPTED
Raw text

A distinct project type for cases that require the original content, such as a regulated investigation. Turned on by you, with a documented reason and an explicit acceptance of the risk.

Every change to content storage, including creating a raw-audit project, notifies the project owner and the compliance role and is written to the audit trail with the reason, the approver and the accepted risk. Raw-audit projects are labelled as such everywhere they appear.
Audit retention scheduleorganisation default
CLASSKEPT FORCONTENT
Decision records7 yearsNone
Tool call records7 yearsSchema only
Redacted prompts and responses30 daysTokenized text
Administrative actions7 yearsActor and change
Authentication events2 yearsNone
Incident working notes3 yearsText
Configurable down to 12 months, or up under legal hold, per organisation
06 Audit retention

Long retention is safe because the records hold no personal data

Keeping seven years of audit history is only defensible if that history is not itself a data liability. Decision records carry decisions, versions and counts, so a long retention period costs storage rather than exposure. Redacted content is a separate class with a much shorter default lifetime, and can be switched off entirely. Records are append-only and sealed segment by segment with Transit HMAC-SHA256, so a deletion is detectable rather than deniable.

Append-only, no edit or delete path for any role, including ours
Expiry is enforced by the platform and recorded when it runs
Export before expiry, or place a named legal hold to suspend it
How records are structured
07 SSO and MFA

Your identity provider decides who gets in

Console access is authenticated against your IdP over SAML 2.0 or OIDC, with SCIM provisioning so a leaver is deprovisioned by the same process that handles the rest of your estate. Group claims map to obstruo roles, so membership is managed where you already manage it. MFA is required, and enforced by your IdP policy rather than a second, weaker one of ours.

SAML 2.0 and OIDC, with SCIM 2.0 user and group provisioning
Enforced SSO, so local passwords stop working once it is on
Session lifetime, idle timeout and IP allow-lists set per organisation
SSO is included on every paid plan, not sold as a security upcharge
Identity configurationENFORCED
ProtocolSAML 2.0
ProvisioningSCIM 2.0, groups on
MFARequired by IdP policy
Local passwordsDisabled
Session lifetime8h, 30m idle
Break-glass account1, hardware key, audited
Machine access uses scoped API credentials with their own expiry, never a human session.
08 Access roles

Separation of duties, including from us

The engineer who ships an agent should not be able to loosen the policy that constrains it, and the auditor reviewing both should not be able to change either. Roles are scoped to the organisation or a single project.

ROLECONFIGURE AGENTSCHANGE POLICYREAD AUDITMANAGE KEYS
OwnerYesYesYesYes
ComplianceNoYesYesNo
Platform engineerYesPropose onlyOwn projectsRotate
DeveloperOwn projectNoOwn projectNo
Auditor, read onlyNoNoYesNo
obstruo supportNoNoOn approvalNo
Support access is off until you grant it, is time-boxed, and is recorded as an access event you can read.
Every policy change is versioned with the member who made it and the time, so you can see what was in force on any date.
The auditor role generates its own read records, so reviewing the evidence is itself evidenced.
09 Subprocessors

A short list, published, with notice before it changes

Model providers are not our subprocessors. You contract with them directly and we route to the ones you approve. These are the parties that support obstruo itself.

SUBPROCESSORPURPOSEREGIONDATA REACHED
Cloud infrastructureCompute, storage, managed databaseEUEncrypted at rest
Edge and DDoSTLS termination at the edge, rate limitingEUTransit only
Error monitoringApplication faults, self-hosted instanceEUNo customer content
BillingInvoicing and payment processingEUBilling contact only
Support deskTicketing for named contactsEUContact details, ticket text
30 days' notice before a subprocessor is added or replaced, with a documented objection window in the DPA.
The current list with legal entities and addresses is in the Trust Center, and is the version referenced by the DPA.
Failure behaviourshipped default, set per project
IF THIS FAILSTHE REQUEST
Redaction engineRefused, or your chosen posture
Guardrail cannot evaluateRefused, or your chosen posture
Policy store unreachableRefused, last known good never assumed
Audit write failsRefused, no unlogged traffic
Chosen provider degradedFailover, within permitted regions
All permitted providers downRefused, never routed elsewhere
WHAT YOUR APPLICATION RECEIVES
503 obstruo_control_unavailable
{ reason: "redaction_unavailable", retry_after: 5 }
A named reason, so your fallback logic can distinguish a control failure from a provider outage. On a pass-through posture the same reason arrives as a header on a served response.
10 Fail-closed behaviour

You choose what happens when a control cannot run

The failure mode is the whole product, so it is your decision rather than ours. Redaction and guardrails ship set to refuse, because a control plane that passes traffic through unredacted when its redaction service is unhealthy has quietly become a proxy. Teams that would rather keep an agent running can set either control to warn, degrade or pass through, per project and per environment.

Refusals carry the control that refused them, not a generic error
Posture set per control and per project, and the setting is itself a recorded change
Every refusal is a record, so an outage is also an audit artefact
11 Availability

A control layer in the request path has to stay up

Fail closed only works if closing is rare. The data path runs active-active across availability zones, and the control plane is separated from the data path so a console outage never stops traffic.

CONTRACTUAL SLA
99.95%
Enterprise, with service credits
TRAILING 90 DAYS
99.99%
Measured at the control plane edge
ADDED LATENCY
~20ms
p50, 41ms at p95
RECOVERY TARGETS
1h / 15m
RTO and RPO targets, first restore test scheduled
Zone redundancy

Active-active across three zones in the project region. Losing one zone costs capacity, not availability.

Separated planes

Policy is evaluated from a local cache in the data path. Console and API deploys do not touch live traffic.

Incident communication

Public status page, named contacts notified within 1 hour, written post-incident review within 5 working days.

12 Secure development

How the code that enforces your policy is built

Nothing exotic. Reviewed changes, tested releases, scanned dependencies, and an external look at the parts that matter most.

Change control
Two-person review on every change, no direct pushes to main
Signed build artifacts
Infrastructure defined as code and reviewed the same way
Testing and scanning
SAST and dependency scanning on every pull request
Redaction regression suite runs before any release
Critical CVEs patched in 72 hours
External assurance
Third-party penetration test planned, summary shared once complete
Security reports to office@obstruo.ai
Background checks and annual security training for all staff
Production access is just-in-time and approved per session. No standing administrative access exists for any engineer, and every elevated session is recorded.
13 Trust Center

The documents your review will ask for

These are public and download immediately. If your review needs something that is not here, ask and we will tell you whether it exists yet.

Data processing agreementProcessing terms, roles and EU SCCs annexed Terms of serviceThe binding contract for using obstruo Acceptable use policyWhat may and may not run through obstruo Privacy noticeWhat we collect, how long we keep it, and why
We do not hold a SOC 2 or ISO 27001 certificate yet, and the first third-party penetration test has not run. When either changes, the report goes here.
Running a vendor assessment on us

Send your questionnaire to office@obstruo.ai. We answer in your format, not ours, and we will tell you plainly where a control is planned rather than in place.

Contact the security team

Your AI. Your data. Your control.

Bring your security team to the first call. The questions on this page are the ones we would rather answer early.

See obstruo in action Evidence and assurance