Security

1. Encryption of provider credentials (BYOK)

When you connect your own model-provider API keys (BYOK), the key is encrypted at rest using AES-256-GCM envelope encryption: each key is protected by a freshly generated data encryption key (DEK), and that DEK is itself wrapped by a key-encryption key (KEK) before the envelope is stored. Only a last-four fragment of a connected key is ever returned by the API or shown in the console.

2. Encryption in transit

Traffic to AI Setu’s hosted services is served over HTTPS, terminated at the load balancer with a certificate issued through AWS Certificate Manager.

3. Tenant isolation

Requests, credentials, and stored data are scoped to your tenant in the gateway’s authentication and BYOK-lookup paths, so one tenant’s traffic and secrets are not reachable through another tenant’s credentials.

4. Access control and audit logging

Administrative and platform-level actions are recorded to an audit log accessible to organization admins, so privileged changes can be reviewed after the fact.

5. What we have not yet formalized

The following are not yet verified or committed to, and should not be assumed until this document is published:

TODO (security review): third-party certifications (e.g. SOC 2, ISO 27001), penetration test cadence and reports, a public vulnerability disclosure program, incident response SLAs, backup/disaster-recovery specifics, and employee access-control/background-check policies. Do not state any of these as fact until verified and approved.