Security & compliance
Security you can put in front of your auditors.
AIFenders is a runtime security control, not a checkbox. Every rail decision maps to the frameworks your buyers' security teams and your investors' diligence already require — OWASP LLM Top 10 (2025), MITRE ATLAS, NIST AI RMF, EU AI Act, ISO/IEC 42001, India DPDP Act 2023 and GDPR — with coverage labelled honestly, not overclaimed.
Live machine-readable coverage · GET /api/frameworks
At a glance
OWASP LLM Top 10 · 2025
Coverage, labelled honestly.
Every guard response also carries the specific framework IDs it enforced against (frameworks.owaspLlm). Labels: addressed a rail directly enforces · partial mitigated, needs more · governance process / logging support.
| Risk | Coverage | How AIFenders enforces it |
|---|---|---|
| LLM01 Prompt Injection | addressed | Input rail — two-layer detection (normalized heuristics + LLM-judge on the ambiguous band). Retrieval rail — indirect-injection scan of every RAG chunk before it enters context. |
| LLM02 Sensitive Information Disclosure | addressed | PII / secret masking on input and in retrieved context; Output rail blocks leaked secrets, echoed PII and system metadata before they reach the caller. |
| LLM03 Supply Chain | governance | Zero runtime dependencies; a model-agnostic upstream that holds no provider key. Vetting upstream models / plugins remains an org control. |
| LLM04 Data & Model Poisoning | partial | Retrieval rail rejects poisoned / injection-laden context at inference time. Training-time poisoning is out of scope for an inference guardrail. |
| LLM05 Improper Output Handling | addressed | Output rail verifies responses for secret / PII leaks, raw SQL and error dumps and unsafe content before they reach the caller — including streaming, chunk-by-chunk, across token boundaries. |
| LLM06 Excessive Agency | addressed | Execution rail risk-scores every tool call; destructive ops and off-domain data egress are denied or routed to human-in-the-loop approval, with RBAC / identity governance. |
| LLM07 System Prompt Leakage | addressed | Input rail detects system-prompt-extraction attempts; Output rail flags system-metadata / initial-prompt disclosure in the response stream. |
| LLM08 Vector & Embedding Weaknesses | partial | Retrieval rail guards content pulled from a vector store (injection + PII in chunks). Embedding-store access control is a data-layer concern. |
| LLM09 Misinformation | partial | Output rail flags hallucinated tool confirmations. Full factuality / grounding against tool-call logs is the documented V2. |
| LLM10 Unbounded Consumption | addressed | Per-tenant usage metering, a cost ceiling on the LLM-judge, and a fail-closed circuit breaker on enforcement degradation. |
Coverage: 6 addressed · 3 partial · 1 governance.
MITRE ATLAS
Adversarial-ML techniques, mapped to rails.
Runtime detections carry these ATLAS technique IDs so findings feed straight into an ATLAS-aligned threat model.
LLM Prompt Injection
Direct and indirect injection caught by the Input and Retrieval rails before the model acts on it.
LLM Jailbreak
Instruction-override and guardrail-evasion attempts scored and blocked by the Input rail.
LLM Data Leakage
Leaked secrets, echoed PII and system metadata caught mid-stream by the Output rail.
LLM Plugin Compromise
Unsafe / off-domain tool use risk-scored and routed to human approval by the Execution rail.
Governance & regulatory posture
Supports your compliance program — it does not replace it.
AIFenders supports compliance; it does not by itself constitute legal or regulatory compliance. Pair it with organizational policy, a signed DPA, a lawful basis for processing, and review by qualified counsel.
| Framework | Posture | How AIFenders supports it |
|---|---|---|
| NIST AI RMF 1.0 | supports | Govern — policy-as-code. Map — the five-rail threat-surface model. Measure — audit log + published benchmarks + latency telemetry. Manage — inline enforcement + circuit breaker. |
| EU AI Act | supports | Logging / traceability, human oversight (HITL) and runtime risk controls that deployers of high-risk AI systems need. Not a standalone conformity assessment. |
| ISO/IEC 42001 AI Management System | supports | Operational controls: documented policy, continuous monitoring / telemetry, and audit trails for the AI system. |
| India DPDP Act, 2023 | supports | PII detection & data minimization (Aadhaar / PAN + global secrets), in-region processing on self-host / VPC, audit of processing. Consent & notice remain the data fiduciary's duty. |
| GDPR | supports | Data minimization via masking, no third-party key custody, self-hostable for data residency. A DPA and lawful basis remain the controller's responsibility. |
Data-handling guarantees
Built in, not bolted on.
- ✓ Raw secrets are never echoed — findings carry the type and location, never the value, in any API response, telemetry field, or audit log.
- ✓ PII masked both ways — masked before the prompt reaches the model and before a response reaches the user (data minimization).
- ✓ No provider-key custody — model-agnostic upstream; in gateway mode keys are masked to last-4 and never returned.
- ✓ Append-only audit log — every rail decision is written immutably (db.appendAudit) for later diligence.
- ✓ Data residency — self-host / VPC deployment keeps all prompts and context in-region (relevant for DPDP + GDPR).
- ✓ Zero runtime dependencies — pure Node.js ≥18, trivially self-hostable inside your own trust boundary.
Platform hardening
How AIFenders itself is secured.
The guardrail is only as trustworthy as the surface it runs on. AIFenders is built to be small, fail-closed, and access-controlled by default.
Login-gated console
No anonymous access. Every rail invocation requires a valid aif_live_… API key; unauthenticated calls are rejected.
Hashed API keys
Keys are stored hashed, never in plaintext. The console shows a masked, last-4 identifier only.
Guarded admin endpoints
Administrative routes sit behind a separate secret token, isolated from the tenant-facing API surface.
SSRF-hardened upstream
The provider connection is DNS-rebinding-safe — the socket is pinned to a validated IP, blocking upstream SSRF.
Fail-closed circuit breaker
On enforcement degradation the breaker trips closed rather than passing traffic through unguarded.
Zero runtime dependencies
Pure Node.js core means a tiny supply-chain surface — nothing to poison in a transitive package tree.
Give your security review something to read.
Launch the console for an API key, or hand your team the full framework mapping and the live machine-readable coverage at /api/frameworks.