Provider keys
Each stored secret gets its own AES-256-GCM data key, wrapped by a cloud KMS. Every decryption is logged. Provider keys, OAuth tokens, and webhook secrets all go through this path.
Security
Security for a gateway that sees every model call
Cloptima sits in your request path, so we design for that. Provider keys are encrypted one secret at a time, prompt content is not stored unless you turn it on, and every request is scoped to the organization in its token.
In the request path
What the gateway holds, and how
The gateway handles your provider keys and your prompts. These are the rules it runs under.
Virtual keys
A virtual key is shown once, when you create it. Cloptima keeps only its hash.
Prompt content
Prompt and response content is not stored by default. On Pro and above you can opt in to keep tool inputs and outputs, or full content, for audit. Retained content sits under a per-customer path and is deleted after 95 days.
Tenant isolation
Every request takes its organization from the signed-in session or token. A request body, query, or header can add attribution, but never changes the organization.
Scoped tokens
Personal access tokens for the CLI, MCP, and API carry explicit scopes. An operation without a mapped scope is refused.
Guardrail scans
Cloptima-managed scans send prompt text to Azure AI Content Safety, AWS Bedrock Guardrails, or Google Model Armor in Cloptima's accounts. Connect your own provider accounts to keep scans in yours.
In your network
Components that run on your side
Nothing here needs Cloptima to connect into your network.
Edge gateway
Runs in your VPC and reads provider keys from your own secrets, so they never leave your cluster. Policy arrives as an Ed25519-signed snapshot that the edge verifies; the edge holds no signing key.
Kubernetes agent
Pushes cluster data out to Cloptima over HTTPS. Its role reads cluster state and writes only its own ConfigMap and Secret.
Cloud accounts
Read-only access: an assumed AWS role with an external ID and Get, List, and Describe permissions, or GCP viewer and BigQuery read roles. No cloud access keys are stored.
The platform
How Cloptima runs
Where the service runs, who can sign in, and what is recorded.
Hosting
The gateway and console run on Azure Kubernetes Service in US West 2. Traffic arrives over TLS through Cloudflare, and the cluster has no public load balancer.
Sign-in
Google, GitHub, or email with verification, brute-force protection, and optional one-time-password MFA. The Enterprise plan adds SCIM user provisioning.
Audit log
Changes to policies, credentials, keys, guardrail bypasses, and cache rules are recorded. Growth and Enterprise plans can export the log.
Data deletion
We delete a customer's data on request, including retained trace content.
Put your first governed call through in five minutes
Point your SDK at the gateway, bind a policy, and watch the first call land on the ledger.
No credit card required
5-minute setup
Free trial