This page exists because your customers' security reviewers will ask exactly these questions. We'd rather answer them here, precisely, than have you find out mid-review.
The Authorization header your agent sends to OpenAI/Anthropic/Groq/etc. is passed through to the upstream provider untouched. Plumb reads only its own x-proxy-key / x-tenant-id headers — your LLM provider key is never logged or persisted.
Detected PII (SSNs, emails, credit cards, phone numbers) is replaced with a token before the request leaves your deployment. The original value is stored in a vault and can only be revealed through an RBAC-gated endpoint scoped to the owning tenant — every reveal attempt (allowed, denied, or not-found) is written to a queryable audit log with the actor, timestamp, and token.
Each proxied request gets a trace ID and a recorded decision path: protocol detected, PII redacted, policy/rule matches, block reasons, upstream status, latency, and token/cost outcome. Traces are tenant-scoped by default and admin-gated behind x-admin-key or an admin/security-role token.
Tenant/API-key records, usage logs (tokens, cost, latency, model), trace metadata and a capped snapshot of the (post-redaction) request body for replay, and the PII vault's tokenized originals. We do not store your provider API keys, and redacted PII is never written to logs in cleartext.
Plumb is a reverse proxy your agent traffic already passes through — the enforcement point is the mechanism, not the product. What you're actually buying is the policy, redaction, and audit layer running inline on that path.
One process, one Docker image. No hidden background services calling out to third parties.
The self-hosted path is Enlil, our source-available engine — the same enforcement code Plumb runs in the cloud, on your infrastructure, with your traffic never leaving your network boundary. No feature gating on the core engine.
Built in Rust — no GC pauses, no buffer-overflow class of bugs common in C/C++ proxy internals.
A recorded trace's (redacted) request can be re-issued against the same upstream and the response diffed by hash — useful for verifying nothing drifted.
We'd rather show you an honest "not yet" than a badge we can't back up. This table is the single source of truth for where we stand.
| Item | Status | Detail |
|---|---|---|
| SOC2 Type II | Roadmap | Not started. We will not claim this is done until an auditor says so. |
| Self-hosted / VPC deployment | Available today | The full proxy — governance, redaction, policy rules, tracing — runs as a single binary you control. |
| Data residency | Your choice | Self-host and nothing leaves your infrastructure. On the hosted tier, see the data-handling section above for exactly what's persisted. |
| Encryption in transit | Standard TLS | Deployed behind HTTPS; no custom crypto claims beyond standard transport security. |
Today: every governance decision (policy blocks, PII redactions, prompt-injection blocks, cache dispositions) is recorded per-request with a trace ID, and every PII vault reveal is written to an audit log — both queryable via the admin-gated API (/api/traces, /api/vault/audit) and the dashboard.
Roadmap:a single exportable, signed, tamper-evident report (PDF/JSON) that bundles this into the artifact a security questionnaire wants, without your team assembling it by hand. This is not built yet — we're listing it here instead of pretending it exists, and it's the top of our backlog.