▶ReclaimLLM
Sign inGet started
← Solutions/Security, Compliance & CTOs

Enterprise AI Security, DLP & Compliance Control Plane

Protect proprietary source code, database credentials, and customer data from leaking to third-party LLM providers. ReclaimLLM provides default-on hook redaction, a governed LLM gateway, encrypted session storage, and complete audit logging.

Explore Trust Center →Privacy controls

Security Architecture

Four Layers of Enterprise AI Defense

Designed for regulated industries and strict data privacy standards. Every security mechanism is active out of the box.

01 / LOCAL HOOK DLP

Pre-Execution Secret Redaction

Native hooks recursively inspect environment variables and files matching .env, *.env, and .envrc. API keys and passwords are replaced with [REDACTED:API_KEY] before model calls or transcript ingest.

02 / LLM GATEWAY

Governed API Access & Scoped Keys

Store OpenAI, Anthropic, Gemini, and Azure OpenAI master credentials centrally. Issue team-scoped gateway keys with strict model access policies and org request logging.

03 / ENCRYPTED STORAGE

Customer Recovery Keys

Raw session transcript blobs are encrypted at rest with AES-256 using a customer-downloaded recovery key. Plaintext content is never accessible to unauthorized actors.

04 / VPC & REGIONS

Data Residency & On-Prem VPC

Select US or EU cloud data residency, or deploy ReclaimLLM's open-source server directly inside your private VPC using Docker or Kubernetes Helm charts.

Compliance Guarantee

Your Data, Your Control

Model Training PolicyNEVER used for model training
Default VisibilityPrivate to user & assigned team
Data Deletion & RetentionConfigurable deletion windows (legal hold in progress)
Export FormatsJSONL, CSV, and HuggingFace-ready archives

Security & CISO FAQs

How does default-on DLP secret masking work in ReclaimLLM?

ReclaimLLM automatically scans file paths matching `.env`, `.env.*`, and `.envrc` for secrets and credentials. Found API keys and tokens are replaced with labeled placeholders (`[REDACTED:API_KEY]`) at the hook level before model execution, storage, or transmission.

How does the Enterprise LLM Gateway protect provider credentials?

Org admins store provider credentials (OpenAI, Anthropic, Gemini, Azure OpenAI) once in the central gateway. Developers receive team-scoped gateway keys restricted by provider and model. Provider master keys never touch developer machines.

How does org-wide session encryption with customer recovery keys function?

Enabling session encryption encrypts raw transcript bodies at rest using AES-256. Admins download a one-time recovery key that is never stored in plaintext on ReclaimLLM servers. Session summaries and high-level search metadata remain searchable without decrypting transcripts.

What options exist for data residency and on-premises deployment?

Paid users can select US or EU data residency. Enterprise customers can deploy ReclaimLLM's open-source server directly inside their private VPC using Docker or Helm, ensuring session data never leaves their network perimeter.

Related reading

Shadow AI coding tools: a CISO checklist →