Documentation

Getting Started

• Integration walkthrough

  The four steps to put SecureAI Guard in front of a model call, with the middleware, API-route and monitoring code.

• What each control does

  Every capability, what it inspects, which published risk it maps to, and an explicit statement of what it does not do.

• Self-hosted and air-gapped deployment

  Running SecureAI Guard inside your own network or VPC, for workloads where prompt content cannot leave your infrastructure.

• Cloud marketplace listings

  Procuring through a cloud provider marketplace, and the current status of each listing.

Security and Trust

• Security overview

  How the service itself is built and operated.

• Trust centre

  Data handling, retention, subprocessors and current audit status — including the questions we cannot answer yet.

• Service status

  Current availability.

Core Concepts

The attack classes and controls these docs assume you know: prompt injection, RAG security, agent permissions, PII redaction.

• Agent security and excessive agency

  An agent turns text generation into action. What excessive agency means, why shared service accounts are the core defect, and the controls that hold.

• AI red teaming for LLM applications

  How to red team an LLM application rather than a model: scope it to your system, build the test set from ATLAS and OWASP, and measure something durable.

• How LLM applications leak sensitive data

  The paths by which data actually escapes an LLM application: provider logs, retrieval, conversation state, agent tools, telemetry, fine-tuning and the index.

• LLM guardrails, and what they can and cannot enforce

  What an LLM guardrail is, the four places one can run, why a model guarding a model shares the same weakness, and how to tell a control from a suggestion.

• PII redaction for LLM applications

  Keeping personal data out of a third-party model without breaking the product: detection limits, redaction versus tokenisation, and when it is wrong.

• RAG security: how retrieval leaks data

  Retrieval moves the security question from the model to the corpus: an index with no access control, poisoned documents, and a second copy of your data.

• The OWASP LLM Top 10 (2025), entry by entry

  All ten entries of the OWASP Top 10 for LLM Applications 2025, what each one actually means in a deployed system, and which control closes it.

• What is prompt injection?

  Prompt injection is what happens when untrusted text reaches a model's instruction context. Direct and indirect forms, why filtering fails, and what helps.

All explainers

Integrations

Where a security layer attaches in each framework and model API, taken from that project's own documentation.

• Amazon Bedrock guardrails and inline security

  How Bedrock's ApplyGuardrail API works, where a separate inline layer attaches, and how to decide which controls belong to the platform and which do not.

• Google Vertex AI and inline LLM security

  The google-genai SDK documents a base_url option for putting a gateway in front of the API — what that pattern enforces, and what routes around it.

• Securing LangChain applications

  Where a security layer attaches in a LangChain agent — the documented middleware hooks, what each one can enforce, and what middleware alone cannot cover.

• Securing LlamaIndex applications

  LlamaIndex instrumentation observes the pipeline rather than intercepting it — where that leaves enforcement in a RAG application, and what to attach instead.

• Supported models and frameworks

  The compatibility matrix for SecureAI Guard. It is not filled in yet, so this page is withheld from search results rather than published with plausible guesses.

• The Anthropic API and inline LLM security

  The Anthropic SDKs document a base_url option and an ANTHROPIC_BASE_URL variable — the cleanest attachment point there is, and what still gets past it.

All integrations

Evaluating and Comparing

How to measure a guardrail on your own traffic, and how the alternatives differ.

• Build vs buy: writing your own LLM guardrails

  What a homegrown LLM guardrail layer really costs to build and keep working, which parts are genuinely easy, and the three that quietly are not.

• LLM firewall vs WAF

  A web application firewall and an LLM firewall inspect different things at different layers. Here is what each one stops, and why one is not a substitute.

• LLM security alternatives, and how to compare them

  The open-source and platform options for guarding an LLM application, described from their own documentation, plus the questions that separate them in a demo.

• How to benchmark an LLM guardrail on your own traffic

  A reproducible method for measuring an LLM guardrail: corpus construction, metric definitions, latency measurement, and the six mistakes that void the result.

All comparisons

Compliance

Obligation-by-obligation reference for the frameworks a review will ask about.

• EU AI Act obligations for LLM applications

  What the EU AI Act (Regulation (EU) 2024/1689) requires of teams deploying LLM applications, and the dates that apply after the 2026 AI Omnibus amendment.

• GDPR and LLM data handling

  How the GDPR applies when personal data goes into a prompt — lawful basis, transfers, DPIAs, retention and subject rights, for teams deploying LLM applications.

• ISO/IEC 42001 for LLM applications

  What ISO/IEC 42001:2023 certifies, how it differs from ISO/IEC 27001, and what an LLM deployment has to produce to survive the audit.

• NIST AI RMF for LLM applications

  What the NIST AI Risk Management Framework (AI 100-1) and its Generative AI Profile (AI 600-1) ask of an LLM deployment, and what a control layer can evidence.

• OWASP LLM Top 10 coverage matrix

  Which OWASP LLM Top 10 risks SecureAI Guard addresses, how, and which it does not address at all — stated per entry, including the gaps.

All compliance guides

Common Questions

Deployment, data handling, latency, false positives and security review, answered only where the answer is complete.

• Data handling questions

  What an inline LLM security layer can see, whether prompt content is retained or used for training, and which of those answers this site does not yet publish.

• Deployment and architecture questions

  Where SecureAI Guard sits in the request path, what a self-hosted deployment needs, whether your code has to change, and what happens if the layer is down.

• Detection accuracy and false positives

  Why we publish no detection rate, what base rates do to a false-positive budget, and how to measure a guardrail on your own traffic before you enforce it.

• Evaluation and security review questions

  Certifications we do not claim, how to get a DPA or questionnaire answered, how to report a vulnerability, and the questions this site deliberately leaves open.

• Latency and performance questions

  What inline inspection actually costs, why streaming is the hard case, and how to measure added latency on your own traffic instead of trusting a vendor figure.

All questions

Glossary

Definitions for the vocabulary used throughout.

• AI bill of materials (AI BOM)

  An AI BOM is the inventory of models, datasets, weights and dependencies behind an AI system — what lets you answer whether you are affected after a disclosure.

• Context window

  The context window is the token budget a model attends to in one request. It is also the security boundary that does not exist: it is all one token stream.

• Data poisoning

  Data poisoning is the deliberate corruption of the data a model learns from — pre-training, fine-tuning or a retrieval index — to change its behaviour later.

• Denial of wallet

  Denial of wallet is an availability attack paid for in invoices rather than downtime. On metered model APIs the cost of a request is attacker-controlled.

• Embedding inversion

  Embedding inversion is reconstructing text from its vector. It is why a vector database must be classified at the same level as the documents it indexes.

• Hallucination

  A hallucination is fluent model output that is not true. It is a security concern, not just a quality one, once a downstream system acts on it.

All terms

Not yet published

These pages do not exist yet, so they are listed without links. This is the complete list — nothing else in this documentation points at a page that has not been written.

• API reference

  Endpoint-by-endpoint reference: authentication and key rotation, request and response schemas, error codes, rate limits and 429 handling, and an OpenAPI document.

• Security model

  Where the control sits relative to your application and the model, what it holds in memory and for how long, the trust boundaries it assumes, and its behaviour on failure — fail open or fail closed, per route.

• Installation and configuration reference

  Package installation, every configuration key with its default, and the environment variables that override them.