Skip to content
Ffloopy
Enterprise-Grade Security

Protect your AI infrastructure

Real-time threat detection, LLM firewall, encryption at rest, and automated incident response — built into every request.

6
Threat Detectors
<1ms
Firewall Latency
XChaCha20
Encryption Standard
7+
PII Patterns Scrubbed

Real-Time Threat Detection

6 parallel detectors monitor volume spikes, brute force, geo anomalies, cost anomalies, firewall threats, and model switching. Redis counters track patterns with sub-millisecond overhead. Alerts appear in your dashboard within seconds.

LLM Firewall

Two-layer defense: safety-tuned LLM via BackendRouter catches injection attacks locally. LLM Firewall adds intent-based content safety. Our benchmarks show the firewall makes requests 8.6% faster than direct calls.

Encryption & Key Management

Provider keys encrypted with XChaCha20-Poly1305 (192-bit nonces). API keys are SHA-256 hashed — we never store the original. Decryption happens only at runtime when forwarding to the provider.

GeoIP Tracking

Every request is geolocated using MaxMind GeoLite2. New countries trigger instant alerts. Track where your API keys are being used and catch stolen credentials from unexpected regions.

Multi-Tier Rate Limiting

Anonymous IP limits, authenticated org limits, and per-key limits — all enforced with atomic Redis sliding windows. Scale horizontally without breaking consistency.

Automatic PII Scrubbing

Emails, CPFs, SSNs, credit cards, phone numbers, API keys, and bearer tokens are automatically redacted from logs. Runs asynchronously — zero impact on request latency.

Security architecture

Built-in protection at every layer

Every request passes through multiple security layers before reaching the AI provider.

Request →Rate Limit →Auth →Subscription →Firewall (LLM Firewall) →Firewall (LLM Firewall) →SSRF Check →Threat Monitor →Provider →Response →Threat Evaluate →PII Scrub →Log
Prevention Detection Response
Controls detail

Line-by-line, what we do.

The short version of a long control matrix. The long version is available under NDA — ask and we'll send it same-day.

Data protection
Encryption at restAES-256-GCM. Per-workspace keys. BYOK available on Enterprise.
Encryption in transitTLS 1.3 only. HSTS + OCSP stapling. mTLS for self-hosted data plane.
Zero-retention modePrompts and completions never written to durable storage. Only aggregate metrics retained.
PII redactionBuilt-in detectors for names, addresses, card numbers, SSNs, PHI. Redaction happens before models see the prompt.
Deletion SLAWorkspace data fully purged within 30 days of contract termination. Verifiable on request.
Identity & access
SSOSAML 2.0, OIDC. Supported: Okta, Azure AD, Google Workspace, JumpCloud, OneLogin, custom IdP.
ProvisioningSCIM 2.0. Just-in-time user creation, group-based role sync, automatic de-provisioning.
RBACFour built-in roles plus custom roles. Scoped per route, environment, and key.
API keysRotatable, scoped, and auditable. Short-lived (1h) session tokens for interactive auth.
Operational security
Background checksAll employees. Production access limited to a named on-call rotation with hardware-key 2FA.
Penetration testingAnnual external pentest. Quarterly internal red team. Reports available under NDA.
Vulnerability managementSnyk + GitHub Advanced Security on every PR. CVSS ≥ 7.0 patched within 72h.
Incident response24/7 on-call. 15-min acknowledgement SLA on P1. Postmortems published to customers within 7 days.
Compliance & audit
SOC 2 Type IICurrent report from Prescient Assurance. Next audit window closes May 2026.
ISO 27001:2022Certified by Schellman, issued 2025-09.
GDPR & data residencyEU data can be kept in EU-only region. DPA template ships with every Team contract.
HIPAABusiness Associate Agreement available on Enterprise. PHI routed only through approved providers.
Audit logsImmutable, cryptographically chained. Streamable to S3, Splunk, Datadog, or any SIEM.
Documents

Security artifacts

Grab what you need. NDA-gated docs send automatically after e-sign; everything else is public.

SOC 2 Type II Report
PDF · NDA required
Request
ISO 27001 certificate
PDF · public
Download
Pentest summary
PDF · NDA required
Request
DPA template
DOCX · public
Download
HIPAA BAA
DOCX · on request
Request
Subprocessors list
Live · public
View

Security is not a premium feature

Every plan includes full security. Start free.

Start Free Read Security Docs
FAQ

Security FAQ

Does the security layer add latency to my requests?+
No. Redis counters add sub-millisecond overhead. The LLM firewall (LLM-based firewall) scans prompts in under 1ms. Our benchmarks show requests WITH all security features are 8.6% faster than direct API calls because connection pooling saves more than the scans cost.
What happens when a threat is detected?+
An alert is created in your dashboard with severity classification (critical, high, medium, low). You can acknowledge, dismiss, revoke the affected API key, or enable rate limiting — all with one click. Duplicate alerts within one hour are automatically suppressed.
How does Floopy protect against cost attacks?+
Three layers: rate limiting caps request volume per key, the LLM firewall blocks malicious prompts before they reach the provider, and real-time threat detection flags spending 5x above your 7-day average. When a cost anomaly is detected, you can immediately revoke the key from the dashboard.
Is my data encrypted?+
Yes. Provider API keys are encrypted at rest using XChaCha20-Poly1305 envelope encryption with KMS-managed keys. Floopy API keys are SHA-256 hashed — we can never see the original. All traffic uses TLS. Logs are automatically scrubbed for PII.
How do I set up periodic threat evaluation?+
Floopy provides a dedicated evaluation endpoint that you can call on a schedule. Authenticate with your security API key as a Bearer token. Without parameters, it evaluates all organizations. Run it every 5-10 minutes via cron, GitHub Actions, or any scheduler.
What compliance standards does Floopy support?+
Floopy provides encryption at rest, automatic PII scrubbing, full audit trails in ClickHouse, architectural separation between gateway and dashboard, RBAC with organization-level access control, and configurable log retention. These features support LGPD, GDPR, and SOC 2 compliance requirements.
Is there a free tier that includes security features?+
Yes. Every Floopy plan — including the free tier — includes the LLM firewall, rate limiting, encryption, PII scrubbing, and threat detection. Security is not a premium feature. 5,000 requests/month free, no credit card required.