Security & Compliance

Security Overview

Data Encryption

Communication Encryption (In Transit)

Data Encryption (At Rest)

PII (Personal Information) Protection

AITracer provides automatic detection and protection of personal information in LLM logs.

Auto-Detection Targets

• Email addresses: xxx@example.com, etc.
• Phone numbers: Japan, US, and international formats
• Credit card numbers: Major card brands supported
• Social Security Numbers (SSN): US format
• My Number: Japanese individual numbers
• IP addresses: IPv4, IPv6

Protection Methods

SDK Configuration Example

tracer = AITracer(
    api_key="at-xxxx",
    pii_detection=True,           # Enable PII detection
    pii_action="mask",            # Masking action
    pii_types=["email", "phone", "credit_card"]  # Specify targets
)

Infrastructure

Cloud Provider

AITracer runs on Amazon Web Services (AWS).

Network Security

• VPC: Resource isolation with private subnets
• Security Groups: Access control based on least privilege principle
• Network ACL: Additional defense at subnet level
• AWS Shield: Protection against DDoS attacks

Access Control

Authentication

• Password Policy: Minimum 8 characters with complexity requirements
• Two-Factor Authentication (2FA): Available on all plans
• SSO: SAML 2.0 support on Enterprise plan
• Session Management: Auto timeout, concurrent session limits

Authorization (Role-Based Access Control)

API Key Security

• Key Rotation: Regular key updates recommended
• Permission Scopes: Access scope restriction per key
• Usage Monitoring: Request count tracking per key
• Instant Revocation: Immediate key invalidation when compromised

Compliance

GDPR (EU General Data Protection Regulation)

• Data Subject Rights: Right of access, rectification, erasure, and portability
• Data Processing Agreement (DPA): Available for Enterprise plan
• Data Location: EU region selection available (Enterprise)
• Privacy by Design: Privacy considerations from the design stage

Japan's APPI (Act on Protection of Personal Information)

• Proper Acquisition: Purpose of use clearly stated
• Security Measures: Technical and organizational measures implemented
• Third-Party Provision: No provision to third parties without consent
• Disclosure Requests: Responses to requests from individuals

Planned Certifications

Incident Response

Monitoring System

• 24/7 Monitoring: Continuous system availability monitoring
• Anomaly Detection: Machine learning-based anomaly pattern detection
• Alerts: Immediate engineer notification upon anomaly detection

Incident Response Process

1. Detection: Detection through monitoring systems or user reports
2. Assessment: Evaluation of scope and severity
3. Response: Containment and recovery operations
4. Notification: Notification to affected users
5. Post-Mortem: Root cause analysis and prevention measures

SLA (Service Level Agreement)

Security Inquiries

For security questions, vulnerability reports, or compliance inquiries, please contact us.

• Security Team: support@aitracer.co
• Vulnerability Reports: support@aitracer.co
• Compliance: support@aitracer.co

If you discover a vulnerability, we ask for responsible disclosure. We will respond promptly after verification.