Security at Neural Router

Security is built into the platform, not bolted on. Every request is authenticated, every workspace is isolated, prompt content is minimized and optionally never stored, and policies are enforced server-side so they can't be bypassed per request. The sections below detail our controls; to report an issue, see Vulnerability disclosure.

We maintain an independent compliance program and can provide reports under NDA.

Customers can sign a Data Processing Addendum (DPA), and zero-retention and residency controls support regulated workloads.

• In transit — TLS 1.2+ for all API and dashboard traffic, with HSTS enforced.
• At rest — AES-256 for stored data and backups.
• Secrets — provider credentials and BYOK keys are encrypted with a managed KMS and isolated per workspace.

Access to production is least-privilege, role-based, and gated behind SSO with mandatory multi-factor authentication. Within the product, organizations get role-based access control (owner, admin, member), SSO enforcement, and granular API key scoping. Administrative access is logged to the immutable audit trail.

API keys are generated with high entropy and shown only once at creation. We store a one-way reference plus the last four characters for display — never the full secret. Revoking a key takes effect immediately. Bring-your-own-provider keys are encrypted at rest and only the last four characters are ever surfaced in the UI.

We minimize what we hold. Routing operates on metadata; prompt and completion content is transient by default and, with zero-retention enabled, is never written to disk. Workspaces can pin inference to a jurisdiction and attach a per-request region audit. We do not use customer prompts or completions to train models. See the Privacy Policy for full detail.

The platform runs on hardened, audited cloud infrastructure across multiple regions with network isolation, automated patching, and infrastructure-as-code change control. Workspaces are logically isolated, and provider failover keeps traffic flowing if an upstream degrades.

We continuously monitor availability and security signals, run health probes against provider endpoints, and auto-suspend providers that breach SLA. We maintain a documented incident response plan and notify affected customers without undue delay, consistent with our contractual and legal obligations.

We welcome reports from security researchers. If you believe you've found a vulnerability, email security@neuralrouter.ai with steps to reproduce. Please give us reasonable time to remediate before public disclosure and avoid accessing or modifying data that isn't yours. We do not pursue legal action against good-faith research that follows this policy.