Skip to content
Ffloopy
EN PT
Sign In Get Started
Get Started
Enterprise-Grade Security

Protect your AI infrastructure

Real-time threat detection, LLM firewall, encryption at rest, and automated incident response — built into every request.

6
Threat Detectors
<1ms
Firewall Latency
XChaCha20
Encryption Standard
7+
PII Patterns Scrubbed

Real-Time Threat Detection

6 parallel detectors monitor volume spikes, brute force, geo anomalies, cost anomalies, firewall threats, and model switching. Redis counters track patterns with sub-millisecond overhead. Alerts appear in your dashboard within seconds.

LLM Firewall

Two-layer defense: safety-tuned LLM via BackendRouter catches injection attacks locally. LLM Firewall adds intent-based content safety. Our benchmarks show the firewall makes requests 8.6% faster than direct calls.

Encryption & Key Management

Provider keys encrypted with XChaCha20-Poly1305 (192-bit nonces). API keys are SHA-256 hashed — we never store the original. Decryption happens only at runtime when forwarding to the provider.

GeoIP Tracking

Every request is geolocated using MaxMind GeoLite2. New countries trigger instant alerts. Track where your API keys are being used and catch stolen credentials from unexpected regions.

Multi-Tier Rate Limiting

Anonymous IP limits, authenticated org limits, and per-key limits — all enforced with atomic Redis sliding windows. Scale horizontally without breaking consistency.

Automatic PII Scrubbing

Emails, CPFs, SSNs, credit cards, phone numbers, API keys, and bearer tokens are automatically redacted from logs. Runs asynchronously — zero impact on request latency.

Security architecture

Built-in protection at every layer

Every request passes through multiple security layers before reaching the AI provider.

Request →Rate Limit →Auth →Subscription →Firewall (LLM Firewall) →Firewall (LLM Firewall) →SSRF Check →Threat Monitor →Provider →Response →Threat Evaluate →PII Scrub →Log
Prevention Detection Response
Controls detail

Line-by-line, what we do.

The short version of a long control matrix. The long version is available under NDA — ask and we'll send it same-day.

Data protection
Encryption at restAES-256-GCM. Per-workspace keys. BYOK available on Enterprise.
Encryption in transitTLS 1.3 only. HSTS + OCSP stapling. mTLS for self-hosted data plane.
Zero-retention modePrompts and completions never written to durable storage. Only aggregate metrics retained.
PII redactionBuilt-in detectors for names, addresses, card numbers, SSNs, PHI. Redaction happens before models see the prompt.
Deletion SLAWorkspace data fully purged within 30 days of contract termination. Verifiable on request.
Identity & access
SSOSAML 2.0, OIDC. Supported: Okta, Azure AD, Google Workspace, JumpCloud, OneLogin, custom IdP.
ProvisioningSCIM 2.0. Just-in-time user creation, group-based role sync, automatic de-provisioning.
RBACFour built-in roles plus custom roles. Scoped per route, environment, and key.
API keysRotatable, scoped, and auditable. Short-lived (1h) session tokens for interactive auth.
Operational security
Background checksAll employees. Production access limited to a named on-call rotation with hardware-key 2FA.
Penetration testingAnnual external pentest. Quarterly internal red team. Reports available under NDA.
Vulnerability managementSnyk + GitHub Advanced Security on every PR. CVSS ≥ 7.0 patched within 72h.
Incident response24/7 on-call. 15-min acknowledgement SLA on P1. Postmortems published to customers within 7 days.
Compliance & audit
GDPR & data residencyEU data can be kept in EU-only region. DPA template ships with every Team contract.
LGPDControlador/operador roles, lawful-basis and purpose declared in the DPA, DPO contact published, and data-subject rights (access, correction, portability, deletion) honored within the workspace deletion SLA.
Audit logsEvery gateway request, routing decision, constraint change, and admin action is recorded with request_id, decision trace, and actor. Queryable in the dashboard and exportable as JSONL.

Security is not a premium feature

Every plan includes full security. Start free.

Start Free Read Security Docs
FAQ

Security FAQ

Does the security layer add latency to my requests?+
No. Redis counters add sub-millisecond overhead. The LLM firewall (LLM-based firewall) scans prompts in under 1ms. Our benchmarks show requests WITH all security features are 8.6% faster than direct API calls because connection pooling saves more than the scans cost.
What happens when a threat is detected?+
An alert is created in your dashboard with severity classification (critical, high, medium, low). You can acknowledge, dismiss, revoke the affected API key, or enable rate limiting — all with one click. Duplicate alerts within one hour are automatically suppressed.
How does Floopy protect against cost attacks?+
Three layers: rate limiting caps request volume per key, the LLM firewall blocks malicious prompts before they reach the provider, and real-time threat detection flags spending 5x above your 7-day average. When a cost anomaly is detected, you can immediately revoke the key from the dashboard.
Is my data encrypted?+
Yes. Provider API keys are encrypted at rest using XChaCha20-Poly1305 envelope encryption with KMS-managed keys. Floopy API keys are SHA-256 hashed — we can never see the original. All traffic uses TLS. Logs are automatically scrubbed for PII.
How do I set up periodic threat evaluation?+
Floopy provides a dedicated evaluation endpoint that you can call on a schedule. Authenticate with your security API key as a Bearer token. Without parameters, it evaluates all organizations. Run it every 5-10 minutes via cron, GitHub Actions, or any scheduler.
What compliance standards does Floopy support?+
Floopy provides encryption at rest, automatic PII scrubbing, full audit trails in ClickHouse, architectural separation between gateway and dashboard, RBAC with organization-level access control, and configurable log retention. These features support LGPD, GDPR, and SOC 2 compliance requirements.
Is there a free tier that includes security features?+
Yes. Every Floopy plan — including the free tier — includes the LLM firewall, rate limiting, encryption, PII scrubbing, and threat detection. Security is not a premium feature. 50,000 requests/month free, no credit card required.