Trust center
Trust Center
- Prompts, responses, and files: never stored
- Masked values: encrypted, 30-day retention
- Hosting: EU by default, on-premises for enterprise
- SOC 2 Type II and ISO 27001: in progress
Prompts and responses are never stored
Maskflare masks traffic in memory as it passes through. Prompt and completion text, file contents, provider keys, and Maskflare keys are never written to logs, traces, or the traffic record. What is recorded per request is metadata only: provider, model, status, latency, token usage, and how many values each rule matched, never the values themselves.
Read the data-handling policy →Encrypted, short-lived token vault
To restore masked values in a response, the original value behind each token is kept encrypted for 30 days. Only the API key whose traffic created a token can resolve it, and token values are never shown in the console.
Hosted in the EU, or on your premises
By default the Maskflare gateway, proxy and data stores run in the European Union, so masking happens before personal data leaves the EU for an AI provider. Enterprises that need it can run Maskflare on-premises, so unmasked data never leaves their own infrastructure.
Access control
Each organization is an isolated tenant with its own environments, rules, and API keys. Every console user signs in with their own account or through single sign-on, with role-based permissions (owner, admin, security, developer, auditor), optional two-factor authentication, four-eyes approval for rule changes, and an audit log of configuration changes.
Compliance status
Our SOC 2 Type II and ISO 27001 audits are in progress. During an evaluation we share our security documentation, data processing agreement and sub-processor list, and we answer security questionnaires. Completed reports will be listed on this page.
Known limits
Audio in voice sessions isn't masked; text events are. Maskflare protects the AI channel and works alongside your SASE, CASB and email DLP rather than replacing them. Unmanaged personal devices and mobile apps are out of reach. Image scanning reads English, German, French and Italian text and refuses handwriting. Names have no checksum, so test unusual names from your own documents; Exact Data Match and custom rules close that gap for your own records.
Sub-processors and security questions
The current list of infrastructure sub-processors and answers to security questionnaires are available on request. To report a security issue, email hello@maskflare.com with "Security" in the subject.