Security & Privacy

Data sent through the API is never used to train GlomaxGPT models by default. Your prompts, completions, and files remain private.

GlomaxGPT has achieved SOC 2 Type 2 certification, independently audited to verify security, availability, and confidentiality controls.

Healthcare organizations can sign a Business Associate Agreement (BAA) with GlomaxGPT to use the API for HIPAA-covered workloads.

No Training Policy

By default, API inputs and outputs are never used to train or improve GlomaxGPT models. This applies to all API customers automatically — no configuration required.

⏱ Zero Data Retention (ZDR)

Enterprise customers can enable Zero Data Retention, where request and response data is not stored on GlomaxGPT servers after the API call completes. Data is held in memory only for the duration of the request.

Data Residency

Choose where your data is processed and stored. GlomaxGPT supports data residency in the United States and Europe (EU), with additional regions planned.

Data Deletion

Delete your files, fine-tuned models, vector stores, and conversation logs at any time via the API or dashboard. Deletion requests are processed within 30 days.

# Delete a file
client.files.delete("file-abc123")

# Delete a vector store
client.vector_stores.delete("vs_abc123")

Data at Rest

All stored data — files, vector stores, fine-tuned models, and logs — is encrypted at rest using AES-256. Encryption keys are managed by GlomaxGPT using AWS KMS with hardware security modules (HSMs).

Data in Transit

All API communication uses TLS 1.2 or higher. TLS 1.3 is preferred and used by default for all new connections. Older TLS versions are not accepted.

Customer-Managed Keys (CMK)

Enterprise customers can bring their own encryption keys (BYOK) using AWS KMS or Azure Key Vault. CMK ensures that only you can decrypt your stored data.

Vector Store Encryption

Vector stores containing your embedded documents are encrypted at rest with AES-256. Each organization's vector store data is isolated with separate encryption keys.

IP Allowlisting

Restrict API access to specific IP address ranges. Only requests originating from your allowlisted CIDR blocks will be accepted, blocking all other sources at the network edge.

Mutual TLS (mTLS)

Enterprise customers can configure mutual TLS to require client certificate authentication in addition to API key authentication. Provides an additional layer of defense against credential compromise.

Private Endpoints

Route API traffic through AWS PrivateLink or Azure Private Link to keep data entirely within your private network, bypassing the public internet.

DDoS Protection

The GlomaxGPT API infrastructure is protected by enterprise-grade DDoS mitigation at the network and application layers. Rate limiting is applied per API key and per organization.

SSO / SAML 2.0

Integrate with your existing identity provider using SAML 2.0. Supported IDPs include Okta, Microsoft Entra ID (formerly Azure AD), Google Workspace, and OneLogin.

Multi-Factor Authentication

Enforce MFA for all organization members. Supports TOTP authenticator apps, hardware security keys (FIDO2/WebAuthn), and SMS (not recommended for high-security environments).

RBAC

Role-based access control with built-in roles (Owner, Admin, Member, Reader) and fully customizable permission sets for granular access management across projects and resources.

SCIM Provisioning

Automate user provisioning and deprovisioning with SCIM 2.0. Sync users and groups from your identity provider and automatically revoke access when employees leave.

Audit Logs

Every admin action, API key creation, settings change, and user management event is logged with actor identity, timestamp, IP address, and resource affected. Logs are retained for 90 days (Enterprise: 1 year).

Usage Monitoring

Monitor token usage, request volumes, error rates, and costs in real time from the dashboard. Set up spend alerts and usage caps to prevent unexpected overages.

Security Alerts

Receive alerts for suspicious activity: unusual API key usage, logins from new locations, failed authentication attempts, and anomalous request patterns.

SIEM Integration

Export audit logs and security events to your SIEM platform via webhook or S3 export. Compatible with Splunk, Datadog, Elastic, and any SIEM that accepts JSON events.