Skip to content
RubiCore
Request a demo

the guarantees

Governed by design. Not by promise.

No adjectives on this page. Everything below is a mechanism — enforced in the schema, the sandbox and the audit log.

the pipeline

Four stages stand between a prompt and a model.

Guardrail pipelineEvery prompt is screened before it reaches the model. Four stages run in order: regex pattern screening, Presidio NLP entity recognition across 25+ PII types, prompt-injection classifiers, then the PII masker. The pipeline returns one of three verdicts — PASS and MASK reach the model, BLOCK stops the run.user promptscreened before the model1regex screenknown patterns2Presidio NLP25+ PII types3classifiersprompt injection4PII maskerredact in placePASSMASKBLOCKreaches the modelstopped
Guardrail pipelineEvery prompt is screened before it reaches the model. Four stages run in order: regex pattern screening, Presidio NLP entity recognition across 25+ PII types, prompt-injection classifiers, then the PII masker. The pipeline returns one of three verdicts — PASS and MASK reach the model, BLOCK stops the run.user promptscreened before the model1regex screenknown patterns2Presidio NLP25+ PII types3classifiersprompt injection4PII maskerredact in placePASSMASKBLOCKreaches the modelstopped

stage 01 · regex screen

Known patterns go first.

Card numbers, keys, identifiers — anything matching a known PII pattern is caught before anything smarter runs.

Guardrail pipelineEvery prompt is screened before it reaches the model. Four stages run in order: regex pattern screening, Presidio NLP entity recognition across 25+ PII types, prompt-injection classifiers, then the PII masker. The pipeline returns one of three verdicts — PASS and MASK reach the model, BLOCK stops the run.user promptscreened before the model1regex screenknown patterns2Presidio NLP25+ PII types3classifiersprompt injection4PII maskerredact in placePASSMASKBLOCKreaches the modelstopped

stage 02 · presidio nlp

Then, the language itself.

Presidio entity recognition reads the prompt in context — 25+ PII entity types, named and located.

Guardrail pipelineEvery prompt is screened before it reaches the model. Four stages run in order: regex pattern screening, Presidio NLP entity recognition across 25+ PII types, prompt-injection classifiers, then the PII masker. The pipeline returns one of three verdicts — PASS and MASK reach the model, BLOCK stops the run.user promptscreened before the model1regex screenknown patterns2Presidio NLP25+ PII types3classifiersprompt injection4PII maskerredact in placePASSMASKBLOCKreaches the modelstopped

stage 03 · classifiers

Injection attempts die here.

Prompt-injection classifiers score every prompt before a model can be talked into anything.

Guardrail pipelineEvery prompt is screened before it reaches the model. Four stages run in order: regex pattern screening, Presidio NLP entity recognition across 25+ PII types, prompt-injection classifiers, then the PII masker. The pipeline returns one of three verdicts — PASS and MASK reach the model, BLOCK stops the run.user promptscreened before the model1regex screenknown patterns2Presidio NLP25+ PII types3classifiersprompt injection4PII maskerredact in placePASSMASKBLOCKreaches the modelstopped

stage 04 · pii masker

Every prompt leaves with a verdict.

Only then does a model get involved.

PASS · goes throughMASK · redacted in placeBLOCK · never arrives

the mechanisms

Six controls. All structural.

  • Multi-tenant isolation at every layer

    Enforced in the primary database, the vector store and object storage — with composite (id, organization_id) foreign keys that make cross-tenant linkage structurally impossible.

  • Dual-plane RBAC

    Platform roles and organization roles resolve on separate planes, so a platform superuser is never mistaken for an org admin.

  • Four-stage AI guardrail pipeline

    Regex PII detection, Presidio NLP entity recognition, prompt-injection classifiers and a PII masker return PASS, BLOCK or MASK before any prompt reaches a model.

  • Envelope encryption

    Chat content is encrypted with a unique per-chat AES-256-GCM data key wrapped by a master key held only in environment config.

  • gVisor-isolated execution

    AI-generated code runs in ephemeral containers under the gVisor kernel with dropped capabilities, resource caps and SSRF protection.

  • Immutable, tamper-evident audit

    Append-only audit database with DB-level UPDATE/DELETE rejection, active tamper detection and automatic forensic backup.

the boundary

Two tenants share the platform. Never a row.

Tenant isolation across three storage layers — primary database, vector store and object storage. In each layer two organizations are kept strictly apart by a single enforced boundary, so separation holds in storage and not only in application queries.ISOLATION AT EVERY STORAGE LAYERPrimary databaseEvery record scoped by org, background jobs includedORG AORG BVector storePer-organization isolation across all embedded contentORG AORG BObject storagePer-organization storage keys on every file pathORG AORG BENFORCED IN STORAGE, NOT ONLY IN QUERIES

isolation is a property of the schema, not a habit of the code.

the pause

Nothing irreversible happens without a person.

Approval gateAn agent run reaches an approval gate and pauses. A human approver approves or rejects. On approval the run resumes with full saved state, the action executes and the result is written to an immutable audit log.human approverapprove / rejectagent runAPPROVALGATEexecuteaudit logpauseapproveresumes with full saved state
  1. Agent proposes an actionupdate ERP · send reply
  2. Guardrails and PII checks runPASS / BLOCK / MASK
  3. Routed to the right approverunified approval inbox
  4. Human approves or editsresumes with saved state
  5. Action executed and loggedimmutable audit trail

the premises

It runs where your data is allowed to live.

On-premise topology: RubiCore platform, Your data & documents, GPU safety models inside the customer trust boundary. Nothing leaves your environment.On-premiseYOUR NETWORKRubiCore platformagents · workflows · approvalsYour data & documentsPostgreSQL · Weaviate · S3GPU safety modelsguardrails · parsingNothing leaves your environment.Private cloud topology: RubiCore platform, Your data & documents, Safety models inside the customer trust boundary. Isolated, in the region your policy requires.Private cloudDEDICATED TENANCYRubiCore platformsingle tenant, no sharingYour data & documentsisolated storesSafety modelsguardrails · parsingIsolated, in the region your policy requires.Hybrid topology: Regulated data, Guardrails & audit inside the customer trust boundary, with Managed services outside it. Policy decides what is allowed to cross.HybridYOUR NETWORKRegulated datastays on-premiseGuardrails & auditPASS / BLOCK / MASK⇅policy gateManaged servicesused where permittedPolicy decides what is allowed to cross.

  • On-premise

    Runs entirely inside your environment, with GPU-hosted guardrail and parsing models so data never leaves.

  • Private cloud

    Dedicated, isolated tenancy in the region your policy requires.

  • Hybrid

    Keep regulated data on-premise while using managed services where it is permitted.

always true

The six guarantees.

  1. Authorization is checked before any sensitive resource loads, so denied requests reveal nothing.

  2. Every database query is scoped to the organization — including background jobs.

  3. Tool capabilities are granted as named, criticality-classified scopes per team.

  4. Reusable assets are referenced by pinned version, so publishing never silently breaks a consumer.

  5. Suspending or removing a user revokes all active sessions instantly.

  6. Per-key and per-IP rate limits, with sub-second global revocation on all external access.

the rest is on paper

The full security package — architecture, controls, data flows — is available under NDA.

Request a demo