NeuroRoute NeuroRoute SISL CloudWorx
Login
Key custodyAccess and identityCompliance 5 min read
05Security/ 9 chapters

Built to pass the security review

A gateway sits in the path of every prompt your company sends, so it inherits your highest security bar. This chapter is written for the reviewer who has to sign off, not the buyer who has to be excited.

See pricing
At a glance
Provider key encryptionAES-256-GCM
Session tokensECDSA P-256 JWT
Prompt retention defaultMetadata only
Audit logAppend-only, exportable
05.1

Key custody

Two kinds of secret pass through NeuroRoute: the provider keys you entrust to it, and the API keys your applications use to reach it. They are handled differently and neither is ever recoverable in plaintext by us.

01

Provider keys are envelope-encrypted

Each key is sealed with a per-organisation data key, which is itself encrypted by a KMS master key. The plaintext key exists only in memory for the duration of an outbound call.

AES-256-GCM · per-org data key · KMS-wrapped
02

API keys are stored as HMAC digests

We keep a keyed digest, never the key. The full value is shown once at creation and cannot be retrieved afterwards — only rotated or revoked.

HMAC-SHA256 · shown once · instant revocation
03

Sessions are short-lived and signed

Portal sessions use ECDSA P-256 signed JWTs with a 30-minute access window and rotating refresh tokens bound to device and IP.

ECDSA P-256 · 30 min access · rotating refresh
What we never store
Plaintext provider API keys
Plaintext NeuroRoute API keys
Prompt or completion bodies, unless you opt in
Model output used for training — ever
What we log by default
Token counts, model, cost and latency
Task classification and routing decision
Actor, key ID and IP for every privileged action
05.2

Access and identity

Four roles, scoped API keys, and an append-only record of who changed what. SSO is available today via generic OIDC; SAML and SCIM are not yet available.

RolePermissionsSeats
OwnerFull control including billing, provider keys and organisation deletion.1 per org
AdminManage API keys, routing policy, members and spend caps. No billing changes.Unlimited
DeveloperCreate and use scoped API keys, read usage and traces. No policy changes.Unlimited
ViewerRead-only access to dashboards and invoices. Cannot see key material.Unlimited

SSO and directory sync

Generic OIDC single sign-on; SAML and SCIM are not yet available.

Scoped API keys

Every key carries a role, an optional model allow-list and a spend cap. Revocation takes effect on the next request.

Append-only audit log

Key creation, policy changes, member changes and exports, each with actor, timestamp and source IP. Exportable to your SIEM.

05.3

Data handling and compliance

Prompt bodies are not retained unless you switch retention on for debugging, in which case they expire on a window you set. PII detection can redact before a prompt ever leaves your region.

ControlDetailStatus
SOC 2 Type IINot yet certified — architecture and controls documentation available on requestNot started
GDPRDPA and SCCs available; EU-only routing supportedCurrent
Data residencyPer-org pinning to US, EU or APAC provider regionsCurrent
Sub-processorsPublished list, 30 days notice of changeCurrent
Self-hosted deployment is available on Enterprise. The gateway runs in your VPC, provider keys never leave your boundary, and NeuroRoute receives only the aggregate metering it needs to invoice you.