Security & Data Protection

Naagmani AI is architected as an intermediary runtime layer positioned securely between your software applications and upstream AI model providers. The runtime handles authentication, request filtering, programmable routing, skills, and observability within a hardened perimeter.

Every incoming request is verified, rate-checked, and authenticated before reaching downstream services.

We provide defense-in-depth mechanisms to ensure that only authorized clients execute platform workloads:

• Scoped API Keys: API keys can be scoped to specific projects, allowed model sets, and spending limits;
• Role-Based Access Control (RBAC): Within organizations, permissions are segregated into administrative, billing, developer, and read-only roles;
• Request Validation & Rate Limiting: Incoming payloads undergo strict schema validation and token-bucket rate limiting to prevent buffer overruns and resource exhaustion;
• Instant Revocation: Compromised or rotated API keys can be revoked immediately via the developer console with sub-second propagation.

A core advantage of the Naagmani runtime is preventing client-side exposure of third-party model credentials. When you configure API keys for OpenAI, Anthropic, Google, or other providers:

• Credentials are encrypted at rest using industry-standard symmetric key encryption;
• Upstream secrets are never transmitted back to client browsers or exposed in public API responses;
• Inference requests are authorized using ephemeral service tokens and dispatched from our secure runtime proxies.

Naagmani enforces strict logical boundary separation across all database, cache, and processing layers:

• Tenant Segregation: All data queries enforce organizational tenant IDs and project UUIDs at the service and database layer;
• Network Sandboxing: Internal microservices communicate within private virtual networks with zero public ingress to internal databases;
• Environment Separation: Production clusters are segregated from testing, sandbox, and development environments.

We protect data in transit and at rest throughout its lifecycle:

• In Transit: All HTTP traffic to and from Naagmani endpoints is strictly encrypted using Transport Layer Security (TLS 1.2 or TLS 1.3). Unencrypted HTTP connections are automatically redirected to HTTPS with HTTP Strict Transport Security (HSTS) headers enabled;
• At Rest: Persistent database volumes, audit log archives, and sensitive configuration tables are encrypted at rest using strong AES-256 standard encryption.

Depending on your organization’s configured plan and runtime settings, Naagmani provides real-time security guardrails, including:

• Prompt Injection Detection: Heuristic and classifier-based filters to identify adversarial injection patterns before passing prompts to foundation models;
• PII Masking & Redaction: Configurable policies to detect and mask sensitive identifiers (such as credit card numbers or government IDs) prior to upstream routing;
• Output Validation: Programmable guardrails to inspect downstream AI outputs against policy constraints before returning data to client applications.

The platform maintains detailed, immutable audit logs for administrative events, including:

• User sign-ins, role changes, and member invitations;
• API key creations, revocations, and configuration modifications;
• Project budget updates and billing transactions.

Security telemetry is monitored around the clock to detect anomalous spikes, geographic anomalies, and brute-force attempts.

We maintain an operational Incident Response Protocol designed to rapidly triage, contain, investigate, and remediate potential security incidents.

In the event of a verified data breach impacting your organization’s personal or confidential information, we will notify affected customers in accordance with applicable statutory timelines, providing transparent forensic insights and recommended containment measures.

We welcome and appreciate the efforts of independent security researchers who identify potential vulnerabilities in our systems. If you believe you have discovered a security flaw in Naagmani AI, we request that you adhere to responsible disclosure practices:

• Do not access or attempt to access customer data or unauthorized accounts;
• Do not degrade system availability or execute denial-of-service tests;
• Provide us with a reasonable opportunity to remediate the vulnerability before public disclosure.

Please submit all security vulnerability reports with reproducible steps to:

Naagmani AI is architected with modern data protection, privacy, and cybersecurity principles at its core. Our administrative processes, cloud environments, and development workflows are maintained to support our customers’ global compliance needs.

Specific compliance obligations depend on your chosen deployment topology, configured AI providers, and applicable jurisdictional regulations. If you require specialized contractual data processing addenda (DPA) or enterprise compliance reviews, please reach out to our enterprise team.