Security & Trust
SafePrompt is a security product. Here is our security posture, data handling practices, and how to report issues.
Data Handling
What we store
- •Request metadata: timestamp, API key hash, validation result (safe/unsafe), threat categories, processing time
- •For blocked prompts only: prompt text and source IP are stored temporarily for network intelligence
- •Safe prompts: prompt text is never stored, only the result is logged
Retention & deletion
- •Blocked prompt text: automatically deleted after 24 hours
- •IP addresses: automatically deleted after 24 hours
- •After 24 hours: only cryptographic hashes (SHA-256) remain for network intelligence, with no personally identifiable information
- •Account data: retained while the account is active, then deleted within 90 days of an account-deletion request
Data in transit & at rest
- ✓All API traffic uses TLS 1.2+ (HTTPS enforced)
- ✓Database encrypted at rest (AES-256)
- ✓API keys are stored as hashed values, so we cannot retrieve your plaintext key
Infrastructure
- •API: Deployed on Vercel serverless functions (AWS us-east-1)
- •Database: Supabase (PostgreSQL), hosted on AWS
- •Frontend: Cloudflare Pages (global CDN)
- •Isolation: Each customer's data is scoped to their API key, with no cross-customer data access
- •Availability: no availability commitment is published yet; design your integration with a fail-open or fail-closed fallback
Subprocessors & Access
Who receives prompt text
Validating a prompt means sending it to a language model. The full list of companies that process prompt content, and their roles, is on the privacy page: OpenRouter as the routing gateway, and Groq, Cloudflare, Together AI and DeepInfra as inference providers. Routing is pinned in code, so a prompt cannot reach a provider outside that list.
Regions
- •API (Vercel): AWS us-east-1.
- •Database (Supabase): AWS. Frontend (Cloudflare Pages): global CDN.
- •Inference providers: operate globally; the specific region for a given request depends on OpenRouter routing and is not pinned to one location. If you require a fixed inference region, contact us before integrating.
Subprocessor changes
The pinned provider list is enforced in code and versioned in git, so any change to who processes prompt content is a reviewable code change rather than a silent configuration switch. Material changes to the privacy page are announced there.
Key management
Provider tokens and database credentials are stored as platform-managed secrets (Vercel environment variables), never in source; a pre-commit and pre-push secret scanner blocks committing live-format keys. Customer API keys are stored hashed, not in plaintext. We do not currently operate a dedicated hardware security module or external key-management service.
Access & audit logging
SafePrompt is operated by a small founding team; production access is limited to that team. Administrative actions on the network block/allow lists are recorded to an audit log. A broader access-review process and per-action audit trail are on the roadmap below and are not yet complete; we describe the current state rather than a target state.
Independent testing
No third-party penetration test has been performed to date. We run a public, reproducible detection benchmark against the production API every six hours and publish every run and every failure. A first external penetration test is targeted to begin once paid usage supports the cost; this line is reviewed each quarter, next review 2026-10-01.
Status & availability
There is no public status page or availability SLA yet. Until one exists, design your integration with an explicit fail-open or fail-closed fallback (the API fails closed on internal errors). A status page is on the roadmap; next review 2026-10-01.
Privacy Compliance
GDPR
- ✓Prompt text and raw IP addresses deleted after 24 hours (hashes retained)
- ✓Data export available on request from your dashboard
- ✓Account and data deletion available from dashboard settings
- ✓Data Processing Agreement (DPA) available on request, email privacy@safeprompt.dev
CCPA
- ✓Right to know: request a copy of your data from dashboard
- ✓Right to delete: delete your account and all associated data from dashboard settings
- ✓We do not sell personal information
Compliance roadmap
- ◎SOC 2 Type 1: not yet started; targeted to begin once paid usage supports the audit cost, reviewed each quarter (next review 2026-10-01)
- ✓GDPR/CCPA requests: prompt text and raw client IPs of blocked requests are deleted after 24 hours by an hourly retention job (cryptographic hashes, including the IP hash, are retained); export and deletion on request (DPA)
Performance
| Metric | Value |
|---|---|
| Detection accuracy | Published as a range and median on safeprompt.dev, re-measured every 6 hours against production |
| Average response time | AI-path median about a second, published with percentiles on safeprompt.dev; pattern-resolved requests return in tens of milliseconds |
| Pattern detection (Layer 1) | tens of milliseconds (pattern-resolved requests only, a minority of traffic) |
| Full metrics | Precision, specificity, F1, balanced accuracy and a Wilson 95% confidence interval on attack recall are published and re-derived every deploy on safeprompt.dev |
| Availability target | Not published |
Responsible Disclosure
If you discover a security vulnerability in SafePrompt, please report it responsibly. We commit to:
- ✓Acknowledge your report within 48 hours
- ✓Provide an initial assessment within 5 business days
- ✓Credit you in the fix announcement (if desired)
- ✓Not pursue legal action against good-faith researchers
Report vulnerabilities to: security@safeprompt.dev
For non-security issues, use support@safeprompt.dev or GitHub Issues.
Contact
- Security issues: security@safeprompt.dev
- Privacy / GDPR / DPA: privacy@safeprompt.dev
- General support: support@safeprompt.dev
- Company: SafePrompt / Reboot Inc, Irvine, California