Security & Trust
SafePrompt is a security product. Here is our security posture, data handling practices, and how to report issues.
Data Handling
What we store
- •Request metadata: timestamp, account association, validation result (safe/unsafe), threat categories, processing time
- •Network intelligence: the free plan contributes blocked prompts. Paid plans contribute safe and blocked prompts while Intelligence Sharing is on, which is the default; switch it off in dashboard settings
- •Conversation context: when deployment session tracking is enabled, a session token requests per-turn storage separately from network-intelligence contribution
Retention & deletion
- •Submitted text and raw IPs: the published privacy policy sets a 24-hour window for text and raw IPs retained in network intelligence
- •Sessions: expire after two hours of inactivity and at most 24 hours. The published API-log retention window is 30 days
- •Retained hashes: prompt and IP hashes are pseudonymous personal data. The published policy retains their records for 90 days; IP hashes are stable rather than rotated every day
- •Data controls: dashboard/API deletion does not remove the retained hash records separately. See the privacy policy for retention and rights; request account closure at [email protected]
Data in transit & at rest
- ✓All API traffic uses TLS 1.2+ (HTTPS enforced)
- ✓Database encrypted at rest (AES-256)
- ✓API keys are stored as hashed values, so we cannot retrieve your plaintext key
Infrastructure
- •API: Served by Cloudflare Workers
- •Database: Supabase (PostgreSQL), hosted on AWS
- •Frontend: Cloudflare Pages (global CDN)
- •Isolation: Each customer's data is scoped to their API key, with no cross-customer data access
- •Availability: no availability commitment is published yet; design your integration with a fail-open or fail-closed fallback
Subprocessors & Access
Who receives prompt text
Validating a prompt means sending it to a language model. The full list of companies that process prompt content, and their roles, is on the privacy page. Read that page for the current processor list, processing roles, and international transfers.
Regions
- •API (Cloudflare Workers): requests run on Cloudflare infrastructure.
- •Database (Supabase): AWS. Frontend (Cloudflare Pages): global CDN.
- •Inference providers: operate globally; the specific region for a given request depends on OpenRouter routing and is not pinned to one location. If you require a fixed inference region, contact us before integrating.
Subprocessor changes
The pinned provider list is enforced in code and versioned in git, so any change to who processes prompt content is a reviewable code change rather than a silent configuration switch. Material changes to the privacy page are announced there.
Key management
Provider tokens and database credentials are stored as platform-managed secrets in the hosting platform, never in source; a pre-commit and pre-push secret scanner blocks committing live-format keys. Customer API keys are stored hashed, not in plaintext. We do not currently operate a dedicated hardware security module or external key-management service.
Access & audit logging
SafePrompt is operated by a small founding team; production access is limited to that team. Administrative actions on the network block/allow lists are recorded to an audit log. A broader access-review process and per-action audit trail are on the roadmap below and are not yet complete; we describe the current state rather than a target state.
Independent testing
No third-party penetration test has been performed to date. Current aggregate measurements are published on SafePrompt; dated external per-case results are linked from the benchmarks page. External testing plans are described on the security page.
Status & availability
There is no public status page or availability SLA yet. Until one exists, design your integration with an explicit fail-open or fail-closed fallback (the API fails closed on internal errors).
Privacy Compliance
GDPR
- ✓Published network-intelligence retention: text and raw IPs, 24 hours; pseudonymous hash records, 90 days
- ✓Data export available on request from your dashboard
- ✓Dashboard/API deletion covers supported account-linked records; retained hash records are excluded
- ✓Data Processing Agreement (DPA) available on request, email [email protected]
CCPA
- ✓Right to know: request a copy of your data from dashboard
- ✓Account closure and data-rights requests: [email protected]; see the privacy policy for self-service deletion limits
- ✓We do not sell personal information
Compliance roadmap
- ◎SOC 2: SafePrompt does not claim certification. See the security page for its current assurance posture
- ✓GDPR/CCPA requests: see the privacy policy for published retention windows, request routes, and deletion limits; a DPA is available on request
Performance
| Metric | Value |
|---|---|
| Detection accuracy | Published as a range and median on safeprompt.dev, re-measured every 6 hours against production |
| Average response time | Current latency percentiles are published on safeprompt.dev; use them when choosing your request deadline |
| Pattern detection (Layer 1) | tens of milliseconds (pattern-resolved requests only, a minority of traffic) |
| Full metrics | Precision, specificity, F1, balanced accuracy and a Wilson 95% confidence interval on attack recall are published and re-derived every deploy on safeprompt.dev |
| Availability target | Not published |
Responsible Disclosure
If you discover a security vulnerability in SafePrompt, please report it responsibly. Our published reporting aims are:
- ✓Aim to acknowledge your report within two business days
- ✓Aim to provide an initial assessment within ten business days
- ✓Credit you in the fix announcement (if desired)
- ✓Apply the scoped safe-harbour rules published on the security page; test only your own account and data
Report vulnerabilities to: [email protected]
For non-security issues, use [email protected] or GitHub Issues.
Contact
- Security issues: [email protected]
- Privacy / GDPR / DPA: [email protected]
- General support: [email protected]
- Company: SafePrompt / Reboot, Inc., Las Vegas, Nevada