Compliance & trust

What we cover, and what we don’t.

A gateway that overstates its coverage is worse than no gateway, because you stop looking. This page is the honest version: the frameworks Garita AI produces evidence for, the OWASP entries it genuinely detects, and the four it does not.

Regulatory frameworks

Controls, and the evidence they leave behind

Regulations live as data, not code. Each maps a data category to an action and a routing rule — and where several apply, the strictest match always wins.

Framework	What the gateway does	Evidence produced
HIPAA	PHI detected on both request and response, and pinned to on-premises inference. Requests fail closed when no compliant endpoint is up.	Per-request decision records; evidence packet with the policy in force
PCI-DSS	Cardholder data detected and redacted or blocked before dispatch, per your tenant's chosen strictness.	Redaction counts, block reasons, per-user activity
GDPR / CCPA	Personal data pseudonymised for the duration of the request and rehydrated in the response, so the model never receives the real values.	Lawful-basis-relevant processing records; category-level reporting
NIST CSF 2.0	Detect and Respond functions covered on the AI request path; Govern supported by per-tenant policy and role-scoped access.	Continuous SIEM feed; audit dashboard by function
FERPA	Student records treated as a regulated category with its own action and routing rule.	Decision records per request; retention-free hashes
GLBA	Financial data category with configurable action, plus per-tenant strictness overrides.	Category-level detection reporting
ITAR / EAR	Export-controlled content pinned to local inference; cloud endpoints are removed from the eligible pool entirely.	Routing decision with the eligible pool recorded
EU AI Act	Transparency and record-keeping supported by the append-only audit log. Formal tooling for the Act is on the roadmap, not shipped.	Audit log; not yet a purpose-built Act report

These are technical controls and records that support your compliance programme. They are not a certification, an attestation, or a legal opinion — and no vendor can give you one by installing software.

OWASP LLM Top 10

Four detected, two controlled, four you own

Most vendors claim the whole list. A gateway sits on the request path, so it can only act on what crosses it — the rest is a boundary, not a blind spot. Four entries stay with you and your model provider, and naming them is what makes the other six checkable.

ID	Risk	Status	How it’s handled
LLM01	Prompt injection	Detected	Weighted-signal detector for instruction override, jailbreaks and constraint nullification
LLM02	Sensitive information disclosure	Detected	Nine data-category classifier plus Presidio, on requests and responses
LLM05	Improper output handling	Detected	The same guardrails applied to model responses, including streamed chunks
LLM07	System prompt leakage	Detected	Extraction attempts detected on the request, leaked instructions caught on the response
LLM06	Excessive agency	Controlled	Tool calling is opt-in per request, and tools are scoped per tenant and per user
LLM10	Unbounded consumption	Controlled	Token and USD budgets enforced before dispatch, per tenant, user and model
LLM03	Supply chain	Your responsibility	Model, adapter and dependency provenance — established when an endpoint is promoted, by you or your model provider
LLM04	Data and model poisoning	Your responsibility	Dataset provenance and pre-promotion evaluation, by whoever trains or fine-tunes the model
LLM08	Vector and embedding weaknesses	Your responsibility	Your retrieval layer — vector-store tenancy, access control and index integrity
LLM09	Misinformation	Your responsibility	Grounding and human review of what the model asserts — no policy engine can adjudicate truth

Detected

A dedicated detector runs on every request and every response, and writes a finding to the audit log.

Controlled

No detector, but the risk is bounded by a control you configure — quotas, allow-lists, opt-in tool calling.

Your responsibility

Nothing on the request path can see it. These live with you and your model provider — model and dataset provenance, retrieval-layer access control, and human review of what the model asserts.

This is a shared-responsibility boundary, the same shape your cloud provider publishes. Knowing which four are yours is more useful than a vendor claiming all ten — because the four you own are the ones nobody else is going to cover for you.

Evidence

What you hand the assessor

Two outputs from one append-only record: a continuous feed for your security team, and a point-in-time bundle for whoever is asking this quarter.

Continuous

SIEM feed

Every decision streams to your SIEM as it happens, tagged with the OWASP and ATLAS identifiers your analysts already pivot on.

Wazuh, Splunk, Sentinel, syslog, CEF or JSON
Per-tenant forwarding to the customer’s own receiver
Signed so the receiver can verify origin

Point in time

Evidence packet

A bundle covering a date range, with a SHA-256 manifest so it can still be verified months after it was produced.

Ships the policy that was actually in force
Per-file digests plus a manifest digest
Safe to send outside the organisation

Connected databases

Governing the reach into your own systems

Letting a model query production data is the point at which most AI pilots stop. These are the controls that make it defensible — and the evidence each one leaves.

Control	What it enforces	Evidence produced
Read-only enforcement	The connection's privileges are verified as read-only, and every model-generated statement is parsed and refused unless it is a read.	Refused-statement audit rows with the rejected SQL
Per-user permits	A user reaches only the connections, tables and data categories their permit names — never the full reach of the connection itself.	Per-user access records, including denials
Column masking	Columns marked sensitive come back masked, and stay masked in the model's answer as well as in the result set.	Masked-column flags on each query record
Catalogue-bound access	A table absent from the catalogue is denied rather than treated as unclassified. Absent metadata is never read as permission.	Denial records naming the uncatalogued object
Credential isolation	Connection strings stay in the gateway. The model receives a schema summary — names only — and never a credential or a row it did not ask for.	Schema summaries are reproducible from the catalogue
PHI opt-in	Reaching a health data store is a per-tenant switch, and those requests inherit the local-only routing rule.	Routing decision with the eligible pool recorded

A permit is evaluated against the table a query actually touches, not only against the catalogue. That distinction matters: it is what stops a table the catalogue has never seen from being treated as unclassified and therefore permitted.

Stated plainly

Three things Garita AI does not do

It does not store your prompts

The audit trail records a SHA-256 hash of each request alongside what was detected and decided — never the content. That is precisely what makes an evidence packet safe to hand to an external auditor.

It does not certify you

No product confers HIPAA, PCI-DSS or GDPR compliance. Garita AI supplies controls and evidence; your programme, your assessor and your policies do the rest.

It does not fail open

If no endpoint satisfies the compliance rules for the data in a request, that request is refused. It is never quietly downgraded to a model that happens to be reachable.

Questions

Compliance FAQ

Is Garita AI HIPAA compliant?

That phrase does not mean anything on its own — HIPAA applies to your organisation, not to a piece of software. What Garita AI does is enforce the technical safeguards that a HIPAA programme requires of an AI workflow, and produce the records an assessor asks for. Deployed on your own infrastructure with local-only routing for PHI, no protected health information reaches a third party at all.

Do you sign a BAA?

For a self-hosted deployment there is usually nothing to sign, because we never handle your data. Where CyberNest hosts the gateway on your behalf, a BAA is part of the engagement. There is also a per-tenant flag that permits BAA-covered cloud models where you have that agreement in place with the provider.

How is the audit trail protected from tampering?

It is append-only, with no update or delete path in the application. Evidence packets add SHA-256 digests per file plus a manifest digest, so a bundle handed to an auditor can be verified independently long after it was produced.

How is access to a connected database restricted?

Three ways at once. The connection itself is verified read-only; the user's permit limits which tables and data categories they may reach and which columns are masked; and the SQL the model generates is parsed before execution, with the permit checked against the table the query actually touches. A table the catalogue has never seen is denied, not permitted by default.

What does 'fails closed' mean in practice?

If a request is classified as carrying regulated data and no available model endpoint satisfies the routing rule for that category — the on-premises model is down, say — the request is refused and the refusal is logged. It is never rerouted to a provider that would have been non-compliant.

Does the classifier catch everything?

No detector does, and a vendor who tells you otherwise is selling. Garita AI runs a regex-and-rules classifier alongside Presidio, both fail-closed, and its coverage of the nine data categories is testable against your own data during the pilot. Coverage is measurable — treat any unqualified claim of total accuracy, ours included, as a reason to test it.

Can we see the policy that was in force on a given date?

Yes. Evidence packets ship the policy set as it stood, not the policy as it stands today, so a decision made six months ago can be read against the rules that actually produced it.

Request a demo

See it run against your own policies

Thirty minutes. We switch on the regulations that apply to you, send the kind of prompts your staff actually send, and show you the audit record that comes out the other side.

Reach us directly

Emailinfo@cybernestsec.com Phone+1 (939) 355-4445 CalendarBook 30 minutes → Vendorcybernestsec.com →

Mon–Fri, 9AM–6PM AST. Existing customers with an incident: use the 24/7 line in your runbook.