Built to be trusted.
routeur.ai routes AI prompts on behalf of your business — your data, your users, and your business logic flow through our gateway. We take that responsibility seriously. This page describes how we protect it, plainly.
Our approach
Security at routeur.ai isn't a feature list — it's how the platform is designed. Five principles run through everything on this page.
- ✓Zero trust. No request, user or service is trusted by default. Every call is authenticated, authorised and verified — inside the platform just as much as at its edge.
- ✓Defence in depth. Every request crosses multiple independent controls — in both directions — so no single failure exposes your data.
- ✓Least privilege. People and services get the minimum access required, and that access is logged and reviewed.
- ✓Metadata-only by default. We can't lose what we don't hold. Prompt and response content is stored only if you explicitly enable retention.
- ✓Assume failure. Redundancy across infrastructure, encrypted backups with tested restores, and a practised incident process.
Platform architecture
routeur.ai runs fully managed on Google Cloud. The platform is built around one architectural rule: the part that touches your prompts holds no state, and the part that holds state never touches your prompts.
The gateway that processes prompts is ephemeral and stateless — no disks, no sessions, nothing persists between requests. Every instance starts from a clean, immutable build.
Accounts, configuration and billing live in a separate control plane that is never on the request path. Policies are projected to the gateway as read-only configuration — the data plane can read its instructions but can never reach back into customer records.
Provider API keys and signing keys live in a dedicated, access-logged secrets store with envelope encryption — never present in source code, build artefacts, or logs.
All routeur.ai infrastructure and stored data is hosted on Google Cloud, currently in the europe-west1 region, with further regions to follow as we grow. Prompts routed to upstream providers are processed in those providers' own regions.
Data in transit
All connections to routeur.ai are encrypted. We enforce modern TLS standards and do not support outdated protocol versions.
- ✓TLS 1.2 minimum, TLS 1.3 preferred on all public-facing endpoints. Older versions are rejected.
- ✓HSTS enforced with a minimum one-year max-age. All plain HTTP is redirected.
- ✓Internal traffic between platform services is encrypted on private networking — never the public internet.
- ✓Upstream provider calls are made over TLS only. There is no unencrypted fallback for any LLM provider connection.
- ✓Beneath the platform, all traffic within the Google network is encrypted by default — see Google's encryption-in-transit documentation.
Data at rest
Everything we store is encrypted at rest, and the most sensitive values are encrypted again at the application layer — so storage access alone never yields usable secrets.
- ✓All stored data is encrypted at rest with AES-256 — databases, secrets and backups alike.
- ✓LLM provider credentials receive envelope encryption on top of storage encryption. Shown once at creation, never retrievable in plaintext afterwards.
- ✓Key management uses a hardened, access-logged key service with rotation. CMEK available on Enterprise plans.
- ✓Automated backups are encrypted, with restores tested regularly. 7-day retention by default, configurable on Enterprise.
- ✓Beneath the platform, Google Cloud encrypts all stored data at rest by default — see Google's default-encryption documentation.
What we store — and what we don't
routeur.ai is metadata-only by default: we store the operational record of each request — for routing, billing, security and observability — and not the content. Content retention is an explicit, customer-controlled opt-in.
- Request timestamp; workspace, route and API-key identifiers
- Provider and model selected; the routing decision and rule that matched
- Tokens in / out (counts), latency and cost estimate
- DLP / shield verdict (pass / blocked) and HTTP status code
- The content of prompts or of LLM responses
- User-level PII from your application
- System prompts or agent instructions
Content retention is an explicit opt-in — enable payload retention for an encrypted, content-level audit trail with windows you control. We never train on your data, and never sell it, whether or not retention is enabled.
Application security
Security controls are applied to every request, in both directions, before any LLM provider sees the data.
Pattern-based and semantic detection identifies prompt injection, jailbreaks and policy violations before the request is forwarded. Blocked requests are logged with the violation type and never reach a provider.
DLP detects PII — names, emails, phone and card numbers, national identifiers — and masks it before the prompt leaves your network. Configurable per routing rule; masking patterns are auditable.
Responses are checked against configurable policies before return. Harmful, toxic or off-brand content can be blocked, flagged or replaced — without changing your application code.
Statistical baselines from your request history. Cost spikes, oversized prompts or burst traffic from a single key trigger configurable alerts to your team.
Access controls
Access to your account and its data is controlled at multiple levels.
- ✓Authentication required for all management functions. Auth endpoints are rate-limited against brute force.
- ✓Single sign-on (SSO). Bring your own identity provider over OIDC, so your team signs in with the credentials and policies they already use — available on Enterprise plans.
- ✓Multi-factor authentication available and strongly recommended; enforceable org-wide on Enterprise.
- ✓Roles, groups & granular permissions — build custom roles from a fine-grained permission set and assign them to users or groups, IAM-style. Enforced server-side, not just in the UI.
- ✓Directory sync (SCIM). Provision and deprovision users and groups automatically from your IdP — access is granted and revoked in lock-step with your directory. Available on Enterprise plans.
- ✓Append-only, tamper-evident audit logs of all admin actions. 7 days on Starter, 90 on Pro, configurable on Enterprise.
- ✓SIEM log export. Stream the audit trail into your own SIEM through managed export sinks, so AI activity sits alongside the rest of your security telemetry — available on Enterprise plans.
- ✓Staff production access requires MFA, is need-to-know, logged and reviewed regularly.
Vendor risk management
routeur.ai connects your application to upstream LLM providers on your behalf — so your data flows through those providers' systems, subject to their own data-processing terms.
Most providers (OpenAI, Google, Anthropic, Mistral) offer a zero-retention API mode or enterprise DPAs on request. Our DLP can mask PII in prompts before they reach any provider.
- ✓We review each provider's security posture and data-handling policies before adding them to the platform.
- ✓routeur.ai, operated by Oliver Tappin Ltd, acts as a data processor under GDPR for customer prompt traffic — see our Data Processing Agreement.
- ✓Customers control which providers are enabled and can disable any of them instantly from the dashboard.
Incident response & resilience
We maintain a documented incident response process and test it regularly.
- ✓Severity-1 incidents are escalated immediately; customer notifications and status updates within 24 hours of confirmation.
- ✓Data breach notification to affected customers within 24 hours of confirmation, ahead of any regulatory requirement.
- ✓Redundancy & disaster recovery — encrypted backups, tested restores, documented runbooks. RTO target 4h, RPO target 1h.
- ✓Post-mortems for all Sev-1 and Sev-2 incidents; Enterprise customers receive a copy on request.
Responsible disclosure
We appreciate the work of security researchers. If you discover a vulnerability, please follow responsible disclosure practices.
Send details to security@routeur.ai — a clear description, steps to reproduce, and potential impact. PGP key available on request.
We'll confirm receipt and provide an initial assessment, and may reach out for clarification.
Please allow 90 days from your initial report before public disclosure, so we can remediate and notify affected users if necessary.
No legal action against researchers acting in good faith under this policy. We don't run a bug bounty yet, but we'll acknowledge your contribution.
Security you can hand to your auditor.
Route a slice of traffic through the governed doorway and see the controls — DLP, shields, audit trail — on every request.
Get early access →