Zero data retention · KVKK & GDPR aligned

Make enterprise AI safe to use

TrustLayer masks, inspects and records every prompt before it ever reaches a model.

Built for heavily regulated sectors

Finance
Insurance
Healthcare
Public sector
Legal

The problem

The only moment you can control is the one before the prompt is sent.

The moment an employee pastes a customer record into a chat window, the data has left the organisation. Nothing done afterwards reverses it: masking, policy and the audit record all have to be applied before the prompt goes out.

The data is now on the provider's side

Once a national ID, IBAN, card number or address is inside the prompt, it has been processed on third-party infrastructure. A later deletion request does not undo having been processed.

The model is a target, and it can be talked around

Jailbreak and prompt-injection attempts are built to get past the model's own safety training. That training is the provider's decision, not your organisation's policy.

An ungrounded answer still sounds fluent

Asked something it has no source for, the model produces a confident answer anyway. Nothing in the answer itself tells the reader it is wrong.

No evidence survives

When an auditor asks what this answer rested on, who asked for it, and what was masked, a chat transcript is not an audit record.

TrustLayer handles all four of these before the prompt is sent, and again before the answer comes back.

System status: live health and response time of dependencies such as PostgreSQL and Redis. A component that is not configured is not hidden — it says so.
Five metric cards. The last two are deliberately separate: one is the time the guard chain adds per request, the other is the model's own response time. Conflated, both stop meaning anything.
The twenty-four-hour curve plots masked and blocked requests on separate lines. Change over time says what a single total cannot.
In the live violation stream every row is one event: its type, its decision, and the user and tenant behind the request.
The lower strip carries four numbers: the share of requests that passed unblocked, hallucinations the judge caught, total fields masked, and tenants with traffic.
Riskiest users and the violation-type breakdown show where the problem concentrates — which department, and which kind.

The TrustLayer security overview dashboard — Twenty-four hours across the organisation: masked and blocked requests, the live violation stream, and the guard chain's overhead per request.

Live proof

Try it yourself.

All three examples below are real engine output; not rewritten for marketing.

What the user typed

Customer record: national ID 10000000146, phone 0532 111 22 33, IBAN TR330006100519786457841326, email ayse.yilmaz@example.com. Summarise this customer's refund request.

What the model receives

The outputs on this page are fixed samples captured from real runs of the engine in the product repository.

< 2ms

Inspection overhead (p95)1

1p95 inspection overhead, covering the Prompt Shield, policy and PII masking chain. Measured over 8,000 prompts (40% clean / 30% PII / 30% attack) with four concurrent workers on an 8-core Apple M-series machine, 2026-08-24. Excludes network, model provider time and database I/O; end-to-end response time depends on the model you choose.

Platform

Five layers, one gateway.

Every request passes through the same order. None of it is skippable.

Data Shield

Catches national IDs, tax numbers, IBANs, card and contact data, and swaps them for format-valid synthetic values before the model sees them.

8 entity types

Prompt Shield

Scores jailbreak and injection attempts with a weighted scorer; anything over the threshold never reaches a model.

threshold 70 / 100

Answer Verification

Checks RAG answers against their source document and flags unsupported claims.

safe · warning · block

Access Control

Knowledge base permissions are role-based: a user never sees content from a document they are not entitled to; not even inside an answer.

document-level isolation

Audit & Cost

Who asked what, when, which rule fired and what it cost; written to an immutable record and exported to your SIEM.

SIEM export

Integration

Two lines change. Your code does not.

TrustLayer exposes an OpenAI-compatible gateway. Your existing client stays as it is; you change the base URL and the key. Switching model provider is likewise a setting, not an application change.

curl "$TRUSTLAYER_URL/v1/chat/completions" \
  -H "Authorization: Bearer $TRUSTLAYER_API_KEY" \
  -H "Content-Type: application/json" \
  -H "X-User-Id: ayse.yilmaz" \
  -H "X-Department: operations" \
  -d '{
    "model": "gpt-4o",
    "messages": [
      { "role": "user", "content": "Bu müşterinin iade talebini özetle." }
    ]
  }'

Endpoint: POST /v1/chat/completions
Auth: Authorization: Bearer tl_…
Alternative: X-API-Key: tl_…
Compose default: http://localhost:8000

The audit record also says who asked

Send the optional X-User-Id and X-Department headers and every audit event carries which user asked, from which department. That is an auditor's first question.

Not supported on this endpoint

Text content only; multi-part and image input are outside this endpoint's scope. The address points at your own deployment — the Docker Compose default is shown above.

See deployment options

How it works

Every prompt passes nine steps.

The order is fixed in the orchestrator: five on the way in, four on the way back. If a step blocks, the next one never runs.

Inbound: before it reaches a model

Mask

Personal data is caught and swapped for synthetic values.

Prompt Shield

Signals are scored; a request over the threshold stops here.

Policy

The organisation's YAML policy is applied: a blocked phrase stops it, a competitor name is redacted.

Retrieve

The knowledge base and this session's ephemeral files are searched.

Grounding

Intent is classified; when a question needs a source and none was found, the model is not let loose.

Outbound: before it reaches the user

Dispatch

The request goes to the provider. All the model ever sees is masked text.

Unmask (phase A)

optional

Tokens are resolved and the text sanitised. The chain deliberately pauses here.

Verify

The answer is judged against exactly the chunks it rests on.

Finalize (phase B)

Internal tokens are stripped and the user's data restored. Only now does the answer return.

can stop the requestoptionalThe unmask step is optionalSee the full architecture

FAQ

What security review asks.

How much latency does it add?

The inspection chain's p95 overhead is under 2 ms (1.01 ms measured under load). What determines your end-to-end response time is the model provider you choose, not this layer.

Is our data retained?

No. Prompt content is never persisted; the masking map lives in memory for the life of the request and is dropped once the answer returns. What reaches the audit log is the event; never raw PII.

Which models does it work with?

OpenAI, Google Gemini and local models via Ollama. TrustLayer is a gateway layer, so switching models changes one setting rather than your application code.

Can we run it on our own infrastructure?

Yes. It comes up with a single Docker Compose command and runs in your own VPC or in an environment with no internet access. In local-model mode no request leaves the machine.

Does it really understand Turkish personal data?

Yes; the detectors are written for Turkey specifically: national ID, tax number, TR IBAN, +90 phone formats and Turkish street-address patterns. Matching is pattern-based and deliberately errs on the cautious side: a suspicious string is masked even when its checksum does not validate. We would rather over-mask than miss one.

Bring your security team's questions.

A 30-minute technical session where we run your own prompts through it live.

Book a demo

Email the security team

Pilot deployment runs in your environment, typically two weeks.