Does the browser extension send my prompts anywhere?

No. The token count, the price, the personal-data and secret checks and the writing suggestions run in the page on your device. Nothing leaves the page unless you connect a workspace and ask the router for a quote or a second opinion - and then only the text you chose to send.

Are prompts and answers stored by the platform?

Not by default. The platform meters the request - tokens, cost, target, latency - and keeps the trace of the decision. The prompt and the answer are kept only when a workspace turns on log_payloads in its policy, and they are deleted with the workspace.

Can a rule be overridden by a good score?

No. Constraints - data boundary, region, tenant, cost and latency ceilings, allowed and denied targets, PII handling - are applied before any strategy scores a candidate. A target that fails a constraint is not in the ranking; the trace lists it under policy rejections with the reason.

How do I prove where a request went six months later?

Every decision and every reported outcome is appended to a hash-chained audit trail per workspace. Export it as CSV or JSONL from the dashboard; each record links to the previous one, so a changed or missing row is detectable.

Security and data control

Enterprise AI security: control what leaves, who may answer, and prove it

Can you safely put OpenSmartRoute between your application and your AI providers? This page answers that in order: personal data and secrets are detected and redacted on the device where a request is written; policy decides in the router which models may receive it; every decision is routed under that policy and written to a hash-chained record an auditor can check. Each control has a state you can see, not a sentence in a policy document.

Open the governance report Read the security guide

What a request passes before a model sees it

Identitythe key, its scopes and the tenant it is pinned to
Personal datae-mails, card numbers, pasted keys swapped for placeholders
Injection guardsteering and gadget attacks stripped before scoring
Policydata boundary, region, budget - who may answer at all
Modelthe pick, under that policy, written to the audit chain

The order the router takes them; each is a control the governance report shows in force.

Input guard
PII redaction
Steering strip
Output guard
Budgets
Circuit breakers
Tracing
Metrics
Audit chain
Decision cache
Routing SLM
Autopilot

Photo: Christina Morillo

On the device

Caught before the prompt leaves.

The browser extension and the desktop app read a draft on the device first. Personal details and pasted secrets are highlighted; one click swaps them for placeholders, one click undoes it. The site never sees the original unless you send it anyway.

Looks for e-mail addresses, phone numbers, card numbers, IBANs, national ids (SSN, Aadhaar), IP addresses, API keys and tokens and pasted secrets
Redact, Undo, Redact and send, Send anyway - the choice stays with the personExtension
The same checks over any app on Windows, macOS and LinuxDesktop
Administrators pin the analysis policy for everyone with managed settingsManaged

In the router

Policy first. Scores second.

Constraints run before any strategy weighs a candidate, so no score can trade them away. The input guard strips injection and steering; PII is redacted before it reaches a model; the output guard flags or blocks leaked secrets on the way back.

Data boundary, region, tenant, cost and latency ceilings, allowed and denied targetsPolicy
Input guard for injection and gadget attacks; a learned detector for steeringGuide
Tool-parameter provenance and resource limits for agents and tools; signed MCP manifestsMCP
Circuit breakers and budgets per target, workspace and tenantEnterprise

On the record

Every decision, provable later.

Decisions and outcomes are appended to a hash-chained audit trail per workspace. Prompts and answers are not kept unless you say so. Who may see any of it is a matter of roles, single sign-on and the keys you rotate.

Hash-chained audit trail of decisions and outcomes, exportable as CSV or JSONLAudit
Payload logging off by default; retention by plan; deleted with the workspacePrivacy
Members with roles, SSO, an organisation's verified addresses, key hygieneMembers
Public status with the readiness checks this deployment passes nowStatus

One policy, every request

A rule the router cannot break, written in plain fields.

The workspace policy is edited from the governance page and applied to every key the workspace holds. It is not a prompt, a suggestion or a weight - a target that fails it is not a candidate, and the trace says so.

Edit the policy Watch a rejection in the trace

Workspace policyyaml

# the workspace policy, as the dashboard writes it
data_boundary: private        # never a public endpoint
region: eu                    # EU targets only
contains_pii: true            # route as if every request may carry PII
deny_targets: [llm-frontier]  # never this one, whatever the score
max_cost_per_1k: 0.01
daily_budget_usd: 250
log_payloads: false           # prompts and answers are not kept

Verified and self-asserted, kept apart

What is checkable today, what is in progress, what is not claimed.

A security questionnaire is answered from this table. Nothing in the first group needs a call with us to verify; the second group is work in progress and says so; the third is what a page like this often implies and this one does not.

16 statements a reviewer checks: 12 verifiable today, 3 in progress, 1 not claimed. Every “verifiable today” row links to evidence you can open without talking to us.

Claim	Status	Evidence, or the gap
Open source under Apache-2.0	Verifiable today	Every package on PyPI and npm, the images and the chart ship with their source under Apache-2.0 - one package for the hosted platform and both editions.
Published threat model and security model	Verifiable today	Trust boundaries, what is and is not protected, and the hardening steps for a self-hosted router.
Safety-routing red-team suite on every change	Verifiable today	Paraphrase, gadget and steering attacks against safety routing gate CI and every release (osr safety --learned-guard).
Automated security scanning	Verifiable today	Static analysis (bandit) over the SDK and the platform API, dependency audits (pip-audit, npm audit) and the red-team suite, on every change and weekly.
Hash-chained audit trail per workspace	Verifiable today	Decisions and outcomes appended to a chain you can export as CSV or JSONL; a changed or missing row is detectable.
Prompts and answers not stored by default	Verifiable today	The platform meters tokens, cost, target and latency and keeps the decision trace; payloads are kept only when a workspace turns on log_payloads.
Single sign-on (OIDC / SAML) and SCIM 2.0 provisioning	Verifiable today	Organizations connect their identity provider; Entra ID, Okta, OneLogin and JumpCloud push and remove members through SCIM 2.0 (RFC 7643 / 7644) with a provisioning token issued per organization.
Two-factor sign-in for people and operators	Verifiable today	Time-based codes with recovery codes for workspace users and for operators of the console; an operator can reset a locked-out person's factor.
Provider keys from a vault, never in the platform database	Verifiable today	A provider connection may reference an Azure Key Vault secret (keyvault://...); the API reads it with its managed identity when the client is built and the value is never written to the database.
Data boundary and region pinned by policy	Verifiable today	A workspace or tenant policy pins a data boundary (for example EU) and a region; a model outside it is never chosen, whatever the request asks for - the trace shows the constraint that excluded it.
Personal data caught before it leaves the device	Verifiable today	The browser extension, the desktop app and the IDE clients redact names, addresses, numbers and secrets on the device, before the text reaches the router or a model.
Public status, incidents and an availability SLA	Verifiable today	Live checks every minute, served requests per day, incidents with their timeline and an RSS feed; each paid plan states its availability commitment and the enterprise agreement carries the credit schedule.
Signed container images and published image scans	In progress	Images are built by a pipeline from tagged releases on pinned bases, with the static analysis and dependency audits above. Signing with provenance attestations and a published vulnerability scan per image are not shipped yet.
Independent security review or penetration test	In progress	The review pack - scope, evidence, reproduction steps, questions - is prepared for a third party; no independent review has been completed yet. The report is linked here when it exists.
SOC 2 Type I	In progress	Targeted. Until a report is issued, the trust page, the security review pack and an architecture call with your security team are the review.
HIPAA, ISO 27001, PCI DSS	Not claimed	No certification or attestation is held. Industry pages describe controls you configure - data boundaries, regions, PII handling, audit - not compliance you inherit.

Questions security teams ask

Straight answers.

Does the browser extension send my prompts anywhere?: No. The token count, the price, the personal-data and secret checks and the writing suggestions run in the page on your device. Nothing leaves the page unless you connect a workspace and ask the router for a quote or a second opinion - and then only the text you chose to send.
Are prompts and answers stored by the platform?: Not by default. The platform meters the request - tokens, cost, target, latency - and keeps the trace of the decision. The prompt and the answer are kept only when a workspace turns on log_payloads in its policy, and they are deleted with the workspace.
Can a rule be overridden by a good score?: No. Constraints - data boundary, region, tenant, cost and latency ceilings, allowed and denied targets, PII handling - are applied before any strategy scores a candidate. A target that fails a constraint is not in the ranking; the trace lists it under policy rejections with the reason.
How do I prove where a request went six months later?: Every decision and every reported outcome is appended to a hash-chained audit trail per workspace. Export it as CSV or JSONL from the dashboard; each record links to the previous one, so a changed or missing row is detectable.

Found something? Report a vulnerability. The security review pack lists what a reviewer examines, how to reproduce the evidence and what was fixed; it is prepared for an independent assessment that has not taken place yet.

For the business

What it does for the risk register.

A trace with every answer
Every decision explained
Which model answered, why it won, what it cost and what the alternatives were - kept for the retention period you set.
Open a trace
Redacted before it leaves
Personal data stays home
Names, numbers and identifiers are removed on your side before the request reaches a provider; prompts are not stored by default.
The security page
Hash-chained audit trail
An audit you can hand over
Decisions, policy changes and sign-ins land in a tamper-evident log, and the governance report summarises them for the people who ask.
What is checkable today

How do we govern which AI models employees use?: Routing rules say which models may answer which requests - by data boundary, region, cost or team - and every request that broke a rule is in the audit trail.
Does the platform store our prompts?: Not by default. The trace keeps the decision, the cost and the model; the prompt text is stored only if you turn retention on for your workspace.
Can we prove to an auditor what happened?: Yes: the audit trail is hash-chained, exportable and summarised in the governance report, and the security page says plainly which controls are checkable today and which are in progress.

Set the policy once. Every request obeys it.

Create a workspace, write the data boundary and the region into its policy, and route a request that breaks it - the trace shows the rejection.

Create a free account Talk to sales

Free plan, no card. Fifteen thousand decisions a month with the full trace.

Enterprise AI security: control what leaves, who may answer, and prove it

Caught before the prompt leaves.

Looks for e-mail addresses, phone numbers, card numbers, IBANs, national ids (SSN, Aadhaar), IP addresses, API keys and tokens and pasted secrets

Redact, Undo, Redact and send, Send anyway - the choice stays with the personExtension

The same checks over any app on Windows, macOS and LinuxDesktop

Administrators pin the analysis policy for everyone with managed settingsManaged

Policy first. Scores second.

Data boundary, region, tenant, cost and latency ceilings, allowed and denied targetsPolicy

Input guard for injection and gadget attacks; a learned detector for steeringGuide

Tool-parameter provenance and resource limits for agents and tools; signed MCP manifestsMCP

Circuit breakers and budgets per target, workspace and tenantEnterprise

Every decision, provable later.

Hash-chained audit trail of decisions and outcomes, exportable as CSV or JSONLAudit

Payload logging off by default; retention by plan; deleted with the workspacePrivacy

Members with roles, SSO, an organisation's verified addresses, key hygieneMembers

Public status with the readiness checks this deployment passes nowStatus

# the workspace policy, as the dashboard writes it data_boundary: private # never a public endpoint region: eu # EU targets only contains_pii: true # route as if every request may carry PII deny_targets: [llm-frontier] # never this one, whatever the score max_cost_per_1k: 0.01 daily_budget_usd: 250 log_payloads: false # prompts and answers are not kept

Claim

Status

Evidence, or the gap

Open source under Apache-2.0

Verifiable today

Every package on PyPI and npm, the images and the chart ship with their source under Apache-2.0 - one package for the hosted platform and both editions.

Published threat model and security model

Verifiable today

Trust boundaries, what is and is not protected, and the hardening steps for a self-hosted router.

Safety-routing red-team suite on every change

Verifiable today

Paraphrase, gadget and steering attacks against safety routing gate CI and every release (osr safety --learned-guard).

Automated security scanning

Verifiable today

Static analysis (bandit) over the SDK and the platform API, dependency audits (pip-audit, npm audit) and the red-team suite, on every change and weekly.

Hash-chained audit trail per workspace

Verifiable today

Decisions and outcomes appended to a chain you can export as CSV or JSONL; a changed or missing row is detectable.

Prompts and answers not stored by default

Verifiable today

The platform meters tokens, cost, target and latency and keeps the decision trace; payloads are kept only when a workspace turns on log_payloads.

Single sign-on (OIDC / SAML) and SCIM 2.0 provisioning

Verifiable today

Organizations connect their identity provider; Entra ID, Okta, OneLogin and JumpCloud push and remove members through SCIM 2.0 (RFC 7643 / 7644) with a provisioning token issued per organization.

Two-factor sign-in for people and operators

Verifiable today

Time-based codes with recovery codes for workspace users and for operators of the console; an operator can reset a locked-out person's factor.

Provider keys from a vault, never in the platform database

Verifiable today

A provider connection may reference an Azure Key Vault secret (keyvault://...); the API reads it with its managed identity when the client is built and the value is never written to the database.

Data boundary and region pinned by policy

Verifiable today

A workspace or tenant policy pins a data boundary (for example EU) and a region; a model outside it is never chosen, whatever the request asks for - the trace shows the constraint that excluded it.

Personal data caught before it leaves the device

Verifiable today

The browser extension, the desktop app and the IDE clients redact names, addresses, numbers and secrets on the device, before the text reaches the router or a model.

Public status, incidents and an availability SLA

Verifiable today

Live checks every minute, served requests per day, incidents with their timeline and an RSS feed; each paid plan states its availability commitment and the enterprise agreement carries the credit schedule.

Signed container images and published image scans

In progress

Images are built by a pipeline from tagged releases on pinned bases, with the static analysis and dependency audits above. Signing with provenance attestations and a published vulnerability scan per image are not shipped yet.

Independent security review or penetration test

In progress

The review pack - scope, evidence, reproduction steps, questions - is prepared for a third party; no independent review has been completed yet. The report is linked here when it exists.

SOC 2 Type I

In progress

Targeted. Until a report is issued, the trust page, the security review pack and an architecture call with your security team are the review.

HIPAA, ISO 27001, PCI DSS

Not claimed

No certification or attestation is held. Industry pages describe controls you configure - data boundaries, regions, PII handling, audit - not compliance you inherit.

Enterprise AI security: control what leaves, who may answer, and prove it

Caught before the prompt leaves.

Policy first. Scores second.

Every decision, provable later.

A rule the router cannot break, written in plain fields.

What is checkable today, what is in progress, what is not claimed.

Straight answers.

What it does for the risk register.

Every decision explained

Personal data stays home

An audit you can hand over

Set the policy once. Every request obeys it.

Enterprise AI security: control what leaves, who may answer, and prove it

Caught before the prompt leaves.

Policy first. Scores second.

Every decision, provable later.

A rule the router cannot break, written in plain fields.

What is checkable today, what is in progress, what is not claimed.

Straight answers.

What it does for the risk register.

Every decision explained

Personal data stays home

An audit you can hand over

Set the policy once. Every request obeys it.