Security at PsiGuard.
PsiGuard is built to handle as little of your sensitive data as possible, and to protect what it does handle. Here's how, in plain terms, with no claims we can't back up.
How we protect your data.
Minimal exposure by design
The API returns only your answer and a coarse protection signal. PsiGuard's internal monitoring signals are produced and kept on our servers. They never cross the wire.
API keys are hashed
We show your key once, then store only a one-way SHA-256 fingerprint of it, never the key itself. You can revoke any key instantly, and rotate by issuing a new one.
Your provider keys, encrypted
If you bring your own AI provider key, it's encrypted at rest and used only to make model requests on your behalf.
Payments handled by Stripe
All card payments go through Stripe, a PCI-DSS-certified processor. PsiGuard never sees or stores your full card number.
Encrypted in transit
All traffic to and from PsiGuard runs over HTTPS, with TLS terminated through Cloudflare in front of our application.
API records expire after 90 days
Each guarded API turn is kept for 90 days so you can review it on your Activity page, then deleted automatically. The API holds no conversation state between calls. You send the context you want used, each time.
Data & sub-processors.
PsiGuard runs on a small set of trusted providers, each handling only what it needs to. To generate a guarded answer, your prompt is sent to the AI model provider configured for your account. Full detail is in our Privacy Policy.
- RenderApplication hosting and storage.
- Firebase / FirestoreAuthentication and database (Google).
- StripePayment processing.
- ResendTransactional email.
- CloudflareDNS, content delivery, and network security.
- AI providersOpenAI, Anthropic, Google, DeepSeek, xAI (response generation).
Our security policies.
The written policies behind the practices above. Each is one page, in plain language, and describes how PsiGuard actually operates, with nothing aspirational. They are the foundation we are building our compliance work on, and you are welcome to review or share them.
- SEC-01 Information Security (what we protect, our principles, who is accountable).
- SEC-02 Access Control (customer sign-in, API keys, admin access, infrastructure accounts, secrets).
- SEC-03 Data Handling & Retention (what data exists, where it lives, how long it is kept, how it is deleted).
- SEC-04 Incident Response (detection, containment, customer notification within 72 hours, review).
- SEC-05 Secure Development & Change Management (version control, review, automatic deploys, rollback, dependencies).
Reporting a vulnerability.
If you believe you've found a security issue, we want to hear from you. Email admin@psiguard.net with the details and steps to reproduce. Please give us a reasonable chance to investigate and fix the issue before disclosing it publicly. We're grateful for responsible reports and will respond as quickly as we can.
Where we are today.
PsiGuard is a small team in active beta. We've built security into the product from the start (the practices above are real and in place today), but we don't yet hold formal certifications such as SOC 2 or ISO 27001. We'd rather tell you exactly what we do than imply more than we can stand behind. As the product matures, we'll expand both our practices and this page, and we're glad to talk through specifics with enterprise teams: admin@psiguard.net.
See also: Privacy Policy · Terms of Service