Security & Responsible Disclosure
Our security posture, compliance packs, and how to report a vulnerability in good faith.
[Legal entity name] and
[jurisdiction] are placeholders that must be completed for your entity and venue.
Effective date: 2026-07-10. Applies to the Routeplane gateway, the managed service, and the open-source (Apache-2.0) core.
Security is the product, not a bolt-on. Routeplane exists to give teams a governed, sovereign path to many model providers — so the gateway itself is built to be a trustworthy boundary. This page describes our posture and how to report a vulnerability.
Security posture
- Memory-safe core. The data plane is written in Rust, eliminating whole classes of memory-safety vulnerabilities on the hot path.
- Deterministic PII & secret redaction. Personal data and secrets are masked on the request path by deterministic rules — not by a model that could be prompted around.
- SSRF & egress guards. Webhook and tool-call destinations are screened to prevent server-side request forgery and unintended egress.
- Tamper-evident audit ledger. Governed decisions are recorded in a hash-chained ledger whose entries are signed, so after-the-fact tampering is detectable.
- OIDC-only infrastructure auth. Our cloud and CI authenticate with short-lived federated (OIDC) credentials — there are no long-lived service-principal secrets to leak.
- Signed, verifiable supply chain. Container images are cosign-signed and carry SLSA provenance and an SBOM; the deploy path verifies signatures before promotion.
- Serverless, scale-to-zero. The platform runs serverless and scales to zero when idle, shrinking the standing attack surface.
- Cell-based tenant isolation. Tenancy is organized into isolated cells, limiting the blast radius of any single-tenant issue.
We do not train on your data
Your prompts, responses, and usage data are never used to train or fine-tune models. Content transits the gateway only to serve the request you made.
Self-host for maximum control
For the strongest data-control posture, run the Apache-2.0 core on your own infrastructure. Your data never leaves your environment except to the providers you explicitly route to, and you own the keys, logs, and audit ledger end to end.
Compliance packs
Routeplane is India-first and built around India’s DPDP Act, with GDPR and HIPAA compliance packs for teams operating under those regimes. Sovereign data-residency routing keeps regulated data in-region as a hard routing constraint. Ask us for the pack relevant to your [jurisdiction].
Responsible disclosure
We welcome reports from security researchers and will work with you in good faith.
- How to report. Email rp_maintainers@routeplane.ai with enough detail to reproduce the issue (affected endpoint or component, steps, and impact). Encrypt sensitive details on request.
- Safe harbor. If you make a good-faith effort to comply with this policy, we will not pursue or support legal action against you for your research. Good faith means: you avoid privacy violations, data destruction, and service degradation; you only interact with accounts you own or have explicit permission to test; and you give us a reasonable opportunity to remediate before public disclosure.
- Out of scope. Denial-of-service, social engineering of our staff or users, physical attacks, and testing against third-party providers you route to (report those to the provider) are not authorized under this policy.
- What to expect. We aim to acknowledge reports promptly, keep you updated on remediation, and credit reporters who wish to be named once an issue is resolved.
Contact
Security contact: rp_maintainers@routeplane.ai.