OBVELO — Privacy Gateway docs
Sign in Start free

Security

How OBVELO keeps personal data out of what a model reads, and out of what we keep. Every sentence on this page describes how the product works.

Private by design

Isolated detection

The name model runs in a container that holds no network permission — not “does not use the network”, but cannot. A test checks it on every change.

Nothing from content stored

The data plane stores nothing from request content; the control plane stores the account, the plan and usage in numbers, and never sees content. Your provider stays on your own credentials.

An audit trail without the data

Which account, which key, which tool, allowed or refused — never the content itself. It answers who sent this and who approved this.

Where your data goes

To your model provider, on your own credentials, on every plan. We do not call a model on our contract. With the SDK the provider is any you like; through the proxy it is the instance's provider, or, on every paid plan, the address you set per key.

Your provider key travels in the request to the provider and is never stored or logged. The mapping that turns tokens back into the real values travels with your request and stays with you — there is no vault on our side.

Hosting

In the EU. Every sub-processor is in the EU or EEA and is entered in our register of processing activities before it is used.

Pseudonymisation, not anonymisation

You keep the mapping, so the answer can be turned back into the document you sent. The sentence keeps its shape, so the model still reads who did what to whom — it just does not learn the name.

OBVELO lowers the personal data your model provider receives and gives you a control point with an audit trail.

Availability

The gateway serves from its last snapshot, so existing customers keep working if the control plane is unavailable; only new registrations wait.