Security

What goes on-chain — and what never does

Only a one-way SHA-256 fingerprint and its signatures are committed to the Verilink’ed ledger. Your prompts, responses, and reasoning traces are never written to the chain. The ledger proves the integrity of a record without exposing its content.

Encryption

Stored request, response, and thinking payloads are encrypted with AES-256-GCM. Traffic to and from the proxy is protected with TLS. Fingerprints are computed over a canonical form of each interaction so that changing a single character is detectable.

Dual cryptographic signing

Every captured interaction is signed twice with ECDSA — once by Aegis and once with your audit key. Two independent signatures mean neither party can forge or alter a record after the fact without detection.

The Verilink’ed ledger is append-only

Records are batched into a Merkle tree and a single root is committed roughly every 30 seconds. Each block locks the one before it, so altering any historical record breaks every block after it — visibly, to anyone who checks. Immutability is the point: it is also why an anchored fingerprint can never be removed.

Hash-only mode for regulated content

For the most sensitive workloads — PHI, privileged material, or anything you would rather we never store — Guardrails can operate in a hash-only mode that retains only the fingerprint and signatures, not the underlying content. You keep the proof; we never hold the data. Talk to us before sending regulated data so we can configure the right mode and put a BAA or DPA in place.

Access and account protection

Console access requires email verification and two-factor authentication (TOTP). Audit keys and provider keys are held server-side and shown to you, never to third parties. Company accounts use owner and member roles so you can grant access without sharing logins.

Availability and fail-open design

The proxy adds minimal latency to each call and is monitored continuously; the live status of the ledger is published on our block explorer. If you need a formal uptime SLA or a dedicated deployment, that is available on Enterprise — contact us to discuss your requirements.

Guardrails is built to fail open: if our audit pipeline (fingerprinting, signing, or storage) ever has a problem after we already have your AI provider’s response, we still return that response to you — your application’s AI functionality never depends on our infrastructure being healthy. The call is flagged as unaudited so you can detect and alert on the gap. See the full breakdown in the docs.

Compliance

Guardrails is built to help you meet audit-trail requirements across frameworks such as HIPAA, the EU AI Act, and emerging state AI laws. A SOC 2 examination is in progress. Custom BAAs and DPAs are available for regulated customers.