ENTROVIK
Start security review
AI security gateway architecture
Entrovik is an enterprise AI security gateway with bidirectional data-loss prevention, content-minimizing defaults, server-enforced isolation, sandboxed policy code, controlled secret access, and auditable decisions.
Secure by default
Entrovik assumes the gateway is high-value infrastructure and makes its safest behavior the normal behavior.
Audit records retain request identity, provider, model, policy decisions, latency, token usage, and estimated cost without storing content. Content retention requires explicit configuration and separate permission.
Tenant scope is enforced in server handlers and persistence queries—not inferred from UI filters. Administrative records, policies, providers, audit data, identities, and usage remain tenant-scoped.
No arbitrary native plugin loading or shell execution. The default policy ABI exposes no filesystem, network, environment, process, or arbitrary host access.
API clients and OIDC identities resolve into tenant-scoped principals. Granular RBAC is checked server-side for policy, pipeline, audit, provider, identity, analytics, and content permissions.
Provider values are never returned through administrative APIs or written to logs. Entrovik supports environment, Kubernetes, Vault, AWS, Google, and Azure secret references.
Timeouts, traps, invalid output, ABI mismatch, and evaluation errors follow declared fail-open or fail-closed behavior, with security-sensitive policies designed to prefer denial.
Policy sandbox
The wazero runtime places hard boundaries around initialization, evaluation, memory, I/O size, and concurrency.
Infinite loops and unresponsive modules are interrupted and converted into controlled policy failures.
Policy memory is capped and inputs or outputs beyond configured ceilings are rejected before they threaten the process.
Concurrency control prevents one busy or adversarial policy from consuming every available execution slot.
Runtime traps, invalid JSON, unsupported ABI versions, and panics return sanitized failures instead of crashing Entrovik.
SHA-256 verification, publisher metadata, trusted publisher configuration, and signed-policy enforcement limit what code is accepted.
Evidence without oversharing
Each audit record can capture the caller, application, model, provider, policies executed, decisions, redaction or block status, latency, usage, and estimated cost. Hash chaining makes later tampering detectable while configurable exporters prepare evidence for downstream security systems.
Review audit architecture →Production hardening
Keep Entrovik private, connect it to enterprise identity and secrets, and operate it with the controls expected of internal infrastructure.
NETWORKRun behind internal ingress and restrict gateway and administration surfaces to approved client networks.
TLSTerminate TLS at trusted ingress or configure HTTPS around every client, administrative, provider, and database path.
DATABASEUse managed PostgreSQL with TLS, backups, and point-in-time recovery for HA; protect and back up SQLite for single-node use.
CONTAINERNon-root distroless images and Kubernetes security contexts reduce container and host attack surface.
OBSERVABILITYTrack blocks, redactions, policy traps and timeouts, upstream failures, rate limits, provider circuits, and request activity.
SUPPLY CHAINPolicy checksums, trust configuration, container signatures, SBOM generation, and build provenance support controlled deployment workflows.
STREAMINGKeep secure buffered SSE as the default, enable guarded live delivery only where policy capabilities permit it, or disable streaming for sensitive tenants.
BROWSERA managed Chrome or Edge extension can inspect prompts and supported text attachments before submission while keeping credentials out of page scripts. Optional response inspection is off by default.
Security review FAQ
Not under the v1 default ABI. Network, filesystem, environment, and process capabilities are not exposed to external policies.
No. Secret values are accepted or resolved server-side, never returned through provider APIs, and excluded from structured logs and sanitized errors.
Tenant scope is enforced server-side in authorization and persistence operations. Negative isolation tests cover cross-tenant access paths.
The runtime stops the evaluation, records the operational signal, and applies the policy's explicit failure behavior. Security-sensitive deployments can require fail-closed decisions.
No. Model POST requests are not automatically retried because a retry can duplicate non-idempotent work and cost. Provider circuits and concurrency controls contain failures instead.
Security engagement
We will map Entrovik against your identity, network, data-handling, secret-management, audit, and availability requirements.