Your keys and your data, kept safe
GuardrailX sits between your agents and the providers: it sees the keys and the calls. Here you find how we handle that, what to do if the service doesn’t answer and who to write to.
- Call content isn’t stored, except for features you turn on
- Servers and data in Italy
- Secrets encrypted with AES-256-GCM
Infrastructure
The technical and organisational measures are described in Annex A of the DPA. Here they are in short.
Servers in Italy
Application and database on Server Plan servers in Italy.
Encryption in transit and at rest
HTTPS only, with HSTS and a strict Content Security Policy. Provider keys and the texts kept for the features you turn on are encrypted with AES-256-GCM, with a key kept outside the database.
gr_ keys
The keys you create in GuardrailX are stored only as a SHA-256 hash: not even we can read them back.
Daily backups
Daily database backup, verified, kept 14 days on the server and 60 days in an encrypted off-site copy.
If GuardrailX doesn’t answer
GuardrailX sits on the path of every call. If it ever stops, for an update, a failure or the network, your agents can call the provider directly instead of stopping too. The dashboard’s Integration tab gives you the code ready to use.
- It switches to the provider directly only if GuardrailX doesn’t answer: connection refused, DNS, network, or 502, 503 and 504 without explanation.
- Intentional blocks stay errors: a spending limit or a loop (429), a wrong key (401), an invalid request (400).
- During the outage limits, anti-loop and the cost log don’t apply: that’s why the app also keeps the real provider key, as a fallback.
// Fallback: if GuardrailX doesn't respond, call the provider directly. async function conRiserva(richiesta) { try { return await viaGuardrailX.chat.completions.create(richiesta); } catch (e) { // intentional blocks (429, 401, 400) stay errors if (!nonRaggiungibile(e)) throw e; return await diretto.chat.completions.create(richiesta); } }
The documents
Processing data on your behalf is governed by the DPA, which is part of the Terms. All documents are available in English too.
Data Processing Agreement
Article 28 GDPR: what we process on your behalf, security measures, sub-processors, breach notification within 48 hours.
Privacy Policy
Your account data: what we process, why, for how long and what your rights are.
Terms of Service
The contract: plans, liability, suspension and closure of the account.
| Sub-processor | Activity |
|---|---|
| Server Plan S.r.l. · Italy | Application server and database |
| Microsoft Ireland Operations Ltd. (Microsoft 365) · EU | Sending alert emails |
| Telegram · outside the EEA, standard contractual clauses | Alerts through the bot, only if you connect it |
| Cloudflare, Inc. · USA, Data Privacy Framework | Network and protection for the website and dashboard; agent calls do not go through it |
Report a security issue
If you find a vulnerability in GuardrailX, write to us. We read every report and we reply.
- Describe the issue and how to reproduce it, with the address or call involved.
- Don’t access other customers’ data and don’t degrade the service to test it.
- Give us time to fix it before making it public.
Questions about security
Do you see my prompts?
They go through the Service to reach the provider, but they aren’t stored. The only exceptions are features you turn on: Model comparisons and Autopilot keep a sample, encrypted, for 30 days.
Where is the data?
On servers in Italy. Suppliers that process it outside the European Economic Area, such as Microsoft for emails, do so with GDPR safeguards: an adequacy decision or standard contractual clauses.
What happens to my provider keys?
You enter them in the project and they stay yours: they are stored encrypted with AES-256-GCM and used only to forward your agents’ calls.
What happens in case of a data breach?
The DPA commits us to notify you without undue delay and in any case within 48 hours of becoming aware of it, with the information available.
Can I install GuardrailX on my own servers?
Yes, with the Enterprise plan: prompts and answers don’t leave your network. Price and terms are in a separate contract.
Put a cap on spending before the next loop.
Start on the Free plan: 5,000 requests a month, no card and no end date.