Security & Data Handling Architecture
Observyze is designed from the ground up for transparency, credential isolation, and data minimization. This document details our exact technical controls and data-handling behavior.
Credential Isolation
Provider keys can remain client-side (SDK), ephemeral in-memory (Proxy), or encrypted via AES-256-GCM authenticated envelopes.
Data Minimization
Disable prompt/completion collection locally via captureContent:false. Deterministic PII redaction cleans telemetry before dispatch.
Tenant Scoping
Authorization middleware and supported database queries scope resources by organization and project identifiers.
Transport Encryption
All public endpoints, SDK telemetry ingestion, and gateway proxy connections require TLS encryption.
Telemetry Collection & Data Minimization
Observyze collects execution metadata necessary for observability, latency percentiles, cost attribution, and reliability monitoring.
What is collected by default:
- Timestamps and span durations
- Model identifier and provider name
- Token counts and estimated spend
- Operation status and error codes
By configuring captureContent: false in the SDK, prompt payloads, completion bodies, raw error stack traces, session identifiers, and user metadata are stripped locally on your client before the trace payload enters the network dispatch buffer.
When enabled (enablePiiRedaction: true, active by default), deterministic regex filters scrub common PII patterns (email addresses, phone numbers, Social Security Numbers, credit card numbers, and API keys) before data leaves your process.
API Key & Credential Custody
Observyze never requires you to compromise on secret security. Depending on your chosen deployment path, provider credentials follow strict custody rules:
SDK Direct Mode
Your application calls the LLM provider directly. Provider API keys remain entirely in your process and are never transmitted to Observyze.
Ephemeral Proxy Header
Your provider key is passed in the request header (x-provider-key). The gateway holds it in-memory only to forward upstream, and excludes it from database persistence and logs.
Encrypted BYOK Vault
Stored provider credentials in the Observyze dashboard are encrypted at rest using AES-256-GCM authenticated envelopes. Plaintext keys are never persisted.
Tenant Scoping & Access Controls (RBAC)
Observyze enforces tenant-scoped resource access across all ingestion pipelines, background queues, and API routes.
Tenant-Scoped Access
Authorization middleware and supported database queries scope all resources strictly by organization and project identifiers. Cross-tenant access is rejected at the API gateway layer.
Role-Based Access Control (RBAC)
Workspace members are governed by role-based permissions (Owner, Admin, Member, Viewer). Destructive actions, secret management, and billing configuration require elevated permissions.
Retention, Storage & Model Training Policy
Hot telemetry retention is governed by project settings and active plan tiers. The platform architecture supports cold storage worker export of gzip NDJSON archives to customer-managed Amazon S3 buckets upon configuration.
Contact us for enterprise custom retention windows and dedicated archiving policies.
Observyze Systems: Observyze does not use customer telemetry, prompts, completions, or application payloads to train any internal, base, or proprietary AI foundation models.
Third-Party Model Providers: When using the SDK or Proxy to dispatch requests to upstream providers (e.g. OpenAI, Anthropic, Google), data handling is governed by your organization's direct commercial agreements and API terms with those providers. Observyze does not control upstream provider data retention or training policies.
Compliance Posture & Certifications
We believe in factual technical transparency rather than marketing claims:
Have questions about your compliance requirements?
Our engineering team is happy to review your data privacy, security questionnaire, or on-premises deployment requirements.
Contact Security & Engineering