The enforcement layer handles the most sensitive traffic a firm has, so it is built like it, from the key ceremony to the signed record.
Each customer gets a dedicated AWS account with an isolated VPC and customer-controlled keys. There is no shared Proxara backend.
No shared multi-tenant surface ever holds customer data.
Bedrock runs in the customer account. Inference stays in their AWS, and Bedrock stores no inputs or outputs.
Redaction and the signed audit log are one path. Every intercepted event is signed and chained.
KMS keys live in the account. Full control transfers at termination.
AWS is the only subprocessor for the supervision plane. Region is customer-selected.
Every interaction moves through a chain of independent checks, each able to stop a bad outcome on its own. The chain runs in milliseconds. When a check cannot finish in time, the prompt goes through and the fail-safe is written to the record. Work is never blocked.
The same agent runs on every managed device. AI traffic from browsers, desktop apps, and API clients passes one inspection point at the operating system’s network layer, so the audit record has one source. One layer to secure, one layer to audit.
Every interaction is one signed row. Batches are Merkle-rooted every five minutes and can anchor, at the firm’s election, to a public transparency log Proxara does not operate. Any single row verifies offline, with no Proxara service in the path.
Each identity is individually encrypted and keyed.
Erase one key to delete one identity.
Your own dedicated, isolated infrastructure.
Flagged content is held seven days at most for review, then purged. Proxara is a processing layer, not the system of record.
Each control carries a real parameter. Each framework is a status, not a badge.
33controls across these frameworks, auto-tagged per audit event. Full citations in the trust center.
One agent, one per-seat subscription, deployed to the fleet through your MDM. Run it in a dedicated account we manage, or in your own AWS account.
A dedicated, single-tenant AWS account we provision and operate on your behalf.
FootprintDedicated AWS account · customer KMS · multi-AZ VPC
The same product, deployed into your own AWS account from our templates.
FootprintYour AWS account · your keys · no Proxara access
Signed security questionnaires are available on request under NDA.
Architecture, encryption, network isolation, access controls, audit logging, vulnerability management, supply-chain hardening, the cryptographic audit chain, and compliance status.
DocumentGDPR Article 28 addendum covering data processing roles, sub-processors, SCCs, breach notification, audit rights, content-free fleet telemetry, and the cryptographic audit chain.
DocumentThird-party sub-processors engaged by Proxara for managed deployments, including the optional Sigstore Rekor anchoring service for the audit chain. Change notification process and current processor details.
DocumentBusiness Associate Agreement for healthcare customers. PHI safeguards, breach notification, individual rights, HHS access, and the cryptographic audit chain that supports accounting of disclosures under 45 CFR § 164.528.
DocumentHow we handle data on the Proxara website and sandbox. Covers analytics, cookies, CCPA/CPRA, and UK GDPR rights.
DocumentUptime commitments, service credits, support tiers, response times, and maintenance windows for managed deployments. Local-runtime availability for the device agent.
Vendor questionnaires, audit requests, vulnerability reports, architecture deep-dives. Read by the founders and answered personally.
Demos, pricing, deployment scoping, anything not covered above.
