Security

Our approach

LLM Prover is built on AWS and follows the principle of least privilege throughout. All data is encrypted in transit (TLS) and at rest using AWS-managed encryption.

Data isolation

Your data is isolated to your account. Prompts, results, benchmark runs, evaluations, and uploaded files are never accessible to other users or shared across accounts.

Credential handling

Provider API keys and BYOE endpoint credentials are stored using AWS secure parameter and secrets services – never in application code, environment variables committed to source control, or logs. BYOE credentials are encrypted at rest and are never returned in API responses after the initial registration call.

Authentication

User authentication is handled by AWS Cognito. We do not store passwords. Session tokens are short-lived.

Uploaded files

Files you upload for RAG context are stored in private S3 buckets with no public access. Files are scoped to your account and are not used for any purpose other than powering your configured evaluations and benchmarks.

Third-party providers

When you run a comparison or evaluation, your prompts and any context you provide are sent to the LLM providers you select. We do not control how providers handle inference data. You should review each provider’s privacy and security policies before submitting sensitive content. See our Terms of Service for full details on data flow to third-party providers.

Responsible disclosure

Found a vulnerability? Report via our contact page with the subject “Security disclosure”. We take all reports seriously.