Security & governance

Governed by design, not bolted on.

Isolation, guardrails, approvals and audit are enforced on every run — not configured afterwards.

4-stage

AI safety guardrail pipeline

25+

PII entity types detected and masked

30

governance controls

AES-256-GCM

per-chat envelope encryption

Six controls

Stated as mechanisms, not adjectives.

Multi-tenant isolation at every layer

Enforced in the primary database, the vector store and object storage — with composite (id, organization_id) foreign keys that make cross-tenant linkage structurally impossible.

Dual-plane RBAC

Platform roles and organization roles resolve on separate planes, so a platform superuser is never mistaken for an org admin.

Four-stage AI guardrail pipeline

Regex PII detection, Presidio NLP entity recognition, prompt-injection classifiers and a PII masker return PASS, BLOCK or MASK before any prompt reaches a model.

Envelope encryption

Chat content is encrypted with a unique per-chat AES-256-GCM data key wrapped by a master key held only in environment config.

gVisor-isolated execution

AI-generated code runs in ephemeral containers under the gVisor kernel with dropped capabilities, resource caps and SSRF protection.

Immutable, tamper-evident audit

Append-only audit database with DB-level UPDATE/DELETE rejection, active tamper detection and automatic forensic backup.

The guardrail pipeline

Nothing reaches a model unscreened.

Four stages run in order on every prompt. The pipeline returns one verdict.

  • PASSClean prompt continues to the model.
  • MASKPII redacted in place, run continues.
  • BLOCKStopped before a model ever sees it.
Guardrail pipelineEvery prompt is screened before it reaches the model. Four stages run in order: regex pattern screening, Presidio NLP entity recognition across 25+ PII types, prompt-injection classifiers, then the PII masker. The pipeline returns one of three verdicts — PASS and MASK reach the model, BLOCK stops the run.user promptscreened before the model1regex screenknown patterns2Presidio NLP25+ PII types3classifiersprompt injection4PII maskerredact in placePASSMASKBLOCKreaches the modelstopped

Human in the loop

The run stops where you say it stops.

Approval gates pause a run and resume it with full saved state. Nothing executes around them.

The gate

Approval gateAn agent run reaches an approval gate and pauses. A human approver approves or rejects. On approval the run resumes with full saved state, the action executes and the result is written to an immutable audit log.human approverapprove / rejectagent runAPPROVALGATEexecuteaudit logpauseapproveresumes with full saved state

A real approval run

approval-gaterunning
  1. 1

    Agent proposes an action

    update ERP · send reply

  2. 2

    Guardrails and PII checks run

    PASS / BLOCK / MASK

  3. 3

    Routed to the right approver

    unified approval inbox

  4. 4

    Human approves or edits

    resumes with saved state

  5. 5

    Action executed and logged

    immutable audit trail

Tenant isolation

One boundary, held at every storage layer.

Composite (id, organization_id) foreign keys make cross-tenant linkage structurally impossible.

Tenant isolation across three storage layers — primary database, vector store and object storage. In each layer two organizations are kept strictly apart by a single enforced boundary, so separation holds in storage and not only in application queries.ISOLATION AT EVERY STORAGE LAYERPrimary databaseEvery record scoped by org, background jobs includedORG AORG BVector storePer-organization isolation across all embedded contentORG AORG BObject storagePer-organization storage keys on every file pathORG AORG BENFORCED IN STORAGE, NOT ONLY IN QUERIES

Deployment & policy

Where it runs, and what it enforces.

On-premise topology: RubiCore platform, Your data & documents, GPU safety models inside the customer trust boundary. Nothing leaves your environment.On-premiseYOUR NETWORKRubiCore platformagents · workflows · approvalsYour data & documentsPostgreSQL · Weaviate · S3GPU safety modelsguardrails · parsingNothing leaves your environment.Private cloud topology: RubiCore platform, Your data & documents, Safety models inside the customer trust boundary. Isolated, in the region your policy requires.Private cloudDEDICATED TENANCYRubiCore platformsingle tenant, no sharingYour data & documentsisolated storesSafety modelsguardrails · parsingIsolated, in the region your policy requires.Hybrid topology: Regulated data, Guardrails & audit inside the customer trust boundary, with Managed services outside it. Policy decides what is allowed to cross.HybridYOUR NETWORKRegulated datastays on-premiseGuardrails & auditPASS / BLOCK / MASK⇅policy gateManaged servicesused where permittedPolicy decides what is allowed to cross.

Three deployment options

01
On-premise
Runs entirely inside your environment, with GPU-hosted guardrail and parsing models so data never leaves.
02
Private cloud
Dedicated, isolated tenancy in the region your policy requires.
03
Hybrid
Keep regulated data on-premise while using managed services where it is permitted.

Enforced guarantees

  • Authorization is checked before any sensitive resource loads, so denied requests reveal nothing.
  • Every database query is scoped to the organization — including background jobs.
  • Tool capabilities are granted as named, criticality-classified scopes per team.
  • Reusable assets are referenced by pinned version, so publishing never silently breaks a consumer.
  • Suspending or removing a user revokes all active sessions instantly.
  • Per-key and per-IP rate limits, with sub-second global revocation on all external access.

Under NDA

The full security package.

  • Architecture and data-flow diagrams
  • Control documentation, mechanism by mechanism
  • Deployment, isolation and key-handling review

We publish mechanisms, not badges. Ask us something specific and we will answer it in writing.

Request a demoShow us a process