Security and access control

Secure AI deployments

LLMLab gives every agent, pipeline, model, integration, secret, and knowledge source a clear permission boundary, so AI systems can work across your organization without unrestricted access.

Our Encryption

Access model Roles and permissions govern access to every aspect of your organization

Org scoped

Request context

Authenticated user

Active organization and membership status are loaded before workspace actions continue.

Role grants Role based permissions

Every user and deployment surface carry an assigned role that define permissions.

Permission checks to

Open tabs/panels

View/edit/run resources

Manage settings/permissions

Resource rules

Pipelines, models, API connections, knowledge bases, and codebases each carry distinct permission rules for each resource.

Runtime visibility Inspectable pipeline runs modeled node by node, instead of one opaque prompt

Action review Structured action outputs with request bodies, status, errors, and runtime context

Secret isolation Org-controlled secret access keeps raw values out of prompts, logs, and LLM context

Data handling Optional anonymization can remove identifying details from stored content

Encryption

Encrypted payload storage with managed and client-controlled key paths

LLMLab supports Google Cloud KMS-backed encrypted payloads and a private-DEK path for customer-controlled decryption. The private-DEK path keeps the data encryption key client-owned, so LLMLab cannot decrypt protected private records without that key.

Our Encryption

KMS path

Google Cloud KMS-backed encryption

Connected-service payloads, webhook secrets, API keys, OAuth state, and knowledge base text chunks can be modeled as encrypted records with managed key custody.

Google Cloud KMS Encrypted JSON Managed custody

Private key path

Private DEK encryption

For higher-sensitivity paths, organizations can use a client-held data encryption key for secrets, stored text chunks, and logs.

Client-held DEKs AES-GCM No server-side DEK storage

Recovery path

Recovery without plaintext custody

Recovery phrases can wrap private DEKs so they remain recoverable but protected.

Recovery phrases HKDF-SHA256 Customer control

Versioned payloads

Encryption metadata travels with the data

Records carry encryption version, algorithm, key reference, nonce, and recovery metadata where applicable for safer rotation and migration.

Versioning Rotation-ready Metadata

Build with boundaries

Access control and encryption are part of the system

Use LLMLab to connect context, pipelines, configured API actions, permissions, answer memory, model routing, hosted interfaces, and encryption in one managed platform.

Our Encryption