Corporate information and policies

Legal entity

CyberNest Secure LLC

Product

Garita AI, a compliance-aware AI gateway

Jurisdiction

Commonwealth of Puerto Rico, United States

Registered address

405 Esmeralda Ave, Suite 2-223, Guaynabo, PR 00969, United States.

Registration number

CyberNest Secure LLC is a limited liability company organized in the Commonwealth of Puerto Rico. Its merchant registration and tax identifiers appear on every invoice and are provided on request.

General contact

info@cybernestsec.com · +1 (939) 355-4445

Privacy contact

info@cybernestsec.com, subject line “Privacy”.

CyberNest Secure LLC is a cybersecurity consulting firm in Puerto Rico. Its practice is virtual CISO services, penetration testing, risk assessment and audit readiness for healthcare, government and other regulated organizations. Garita AI is its software product. Consulting engagements are governed by their own written agreements and are not covered by the terms below.

2.1The agreement

These terms apply to the customer named in an order form, quote or statement of work that references them. Where that document and these terms conflict, that document governs. Fees, term, user counts and any service levels are set there, not here.

2.2Two delivery models, and why the difference matters

Garita AI is provided either self-hosted, on infrastructure the customer controls, or hosted by CyberNest on the customer's behalf. The distinction runs through every document on this page:

• Self-hosted. The software runs on the customer's servers against the customer's database. CyberNest does not receive, store or process the customer's prompts, responses, audit records or connected data. The customer is the controller and the sole processor of its own data.
• CyberNest-hosted. CyberNest operates the software on the customer's behalf and processes customer data as a processor, on the customer's documented instructions, under the Personal Data Protection Policy in Section 5 and a separate data processing agreement.

2.3Model providers and API keys

Garita AI routes requests to language models. Customers supply their own provider credentials, and their relationship with each model provider — including that provider's own terms, pricing and data handling — is between the customer and that provider. CyberNest is not a party to it and does not resell model usage.

2.4No guarantee of compliance or security

Garita AI supplies technical controls and evidence that support a compliance program. It does not confer, certify or guarantee compliance with HIPAA, PCI DSS, GDPR, or any other law or framework, and no software can. It does not guarantee that regulated data will never be misclassified, that every attack will be detected, or that systems will be free of vulnerabilities. Coverage and its limits are described on the Compliance page and should be tested against the customer's own data before reliance.

2.5Customer responsibilities

• Configuring which regulations apply, and reviewing that configuration as its obligations change.
• Managing its own users, credentials, permits and connected database logins.
• Ensuring it has the right to process the data it puts through the gateway.
• For self-hosted deployments: operating, patching, backing up and securing the infrastructure.

2.6Intellectual property

Garita AI, the Garita name and mark, and all software and documentation remain the property of CyberNest Secure LLC. The customer receives a non-exclusive, non-transferable right to use the software for the term and scope of its order. Customer data, prompts, configuration and generated output remain the customer's property.

2.7Warranties

The software is provided “as is” except where an order form states otherwise. CyberNest does not warrant uninterrupted or error-free operation. Any service level applicable to a hosted deployment is stated in the order form; where the order form is silent, no service level is implied.

2.8Limitation of liability

To the fullest extent permitted by law, neither party is liable for indirect, incidental or consequential damages. Each party’s total liability under the agreement is capped at the fees paid by the customer in the twelve (12) months preceding the event giving rise to the claim, except for a party’s breach of its confidentiality or data-protection obligations, or any liability that cannot be limited by law.

2.9Term, termination and what happens to data

Either party may terminate as set out in the order form. On termination of a hosted deployment, CyberNest will make customer data available for export for thirty (30) days and then delete it, except where retention is required by law. Self-hosted deployments hold their data throughout; termination ends the license to use the software, not the customer’s access to its own database.

2.10Governing law

These terms are governed by the laws of the Commonwealth of Puerto Rico, and the parties submit to the exclusive jurisdiction of its courts.

2.11Changes

Material changes will be notified to the customer contact on record at least thirty (30) days before they take effect.

3.1Scope

This policy applies to every user of a Garita AI deployment. The customer is responsible for its users' compliance with it, and for having an internal policy at least as strict.

3.2Prohibited uses

• Unlawful activity — anything that violates applicable law, including the export controls the gateway is configured to enforce.
• Data the customer has no right to process — personal data, health information or confidential material obtained without a lawful basis or the necessary consent.
• Defeating the controls — attempting to bypass classification, routing constraints, quotas or the audit trail, including prompt injection aimed at the gateway itself, or configuring policy to create a false record of compliance.
• Attacking the service — unauthorized access attempts, denial of service, or probing infrastructure the customer does not own. This does not prohibit authorized security testing of the customer's own deployment; tell us first if it is hosted by us.
• Reaching data beyond the permit — using connected-database access to retrieve records the user is not authorized to see, or to re-identify masked values.
• Harmful output — generating malware, credential-stuffing tooling, targeted harassment, or content that sexually exploits minors.
• Misrepresenting output — presenting model output as human-authored where that misleads materially, or as professional advice it is not qualified to give.
• Reselling — providing the gateway as a service to third parties without a written agreement permitting it.

3.3Automated enforcement, and its limits

Garita AI enforces some of this automatically — classification, routing constraints, quotas, prompt-injection detection. Automated controls are not a complete substitute for supervision, and a request the gateway allows is not thereby endorsed as acceptable use.

3.4Reporting and consequences

Report suspected misuse to info@cybernestsec.com. For hosted deployments CyberNest may suspend access where use presents an immediate risk to the service or to third parties, and will tell the customer contact promptly. For self-hosted deployments enforcement is the customer's, since CyberNest has no operational access.

4.1This website

garita.ai is a static site with one exception, the self-assessment endpoint described below. It sets no advertising or analytics cookies and runs no third-party tracking. The one third-party script it can load is Cloudflare Turnstile, and only on the self-assessment form, only once you open it: it is there to keep the form from being used to send mail to people who did not ask for it. Specifically:

• Two forms, and what each one sends. The self-assessment sends your name, work email, organization and the level you picked for each question, so we can email you the report and follow up. Its answers are recorded only as that level (none, partial, in place) — it has no free-text field. The demo request sends your name, work email, organization, sector and the message you write in it; that message is the one place on this site where free text is recorded, and it is kept with the enquiry so that whoever replies has read it. Both forms are protected by a bot check (Cloudflare Turnstile) that runs only when you use them.
• Where it goes, and for how long. A submission is buffered briefly in Cloudflare Workers KV, in the account that serves this site, and deleted from there once it reaches CyberNest Secure. From that point it is held in our customer relationship system as a sales enquiry, on the basis of our legitimate interest in answering one you chose to send, and kept while that enquiry or the relationship it leads to is live. Nothing beyond what you typed is stored with your submission — no IP address, no user agent, no cookie. The one exception is the abuse limit: so that nobody can use this form to mail a stranger repeatedly, we hold a one-way hash of your email address and of your IP address as a counter, separate from your submission, and it expires within a day. Write to info@cybernestsec.com to see or delete yours at any time.
• Local storage only. Your language choice and, in the product, your light/dark preference are stored in your own browser. They never leave your device.
• Infrastructure logs. The site is served through Cloudflare, which processes request data such as IP address for delivery, caching and security. Fonts are served by Google Fonts, which receives the request needed to deliver them.
• If you email or call us, we hold what you send in order to reply and to manage the relationship.

This website uses no analytics, advertising or tracking cookies. The only third-party call it makes is the Cloudflare Turnstile check that protects its forms. If that ever changes, this section will be updated before it does.

4.2The product — self-hosted

Where the customer runs Garita AI on its own infrastructure, CyberNest receives no prompts, no responses, no audit records and no connected data. There is nothing for us to disclose, retain or delete, because we never hold it.

4.3The product — hosted by CyberNest

Where CyberNest operates the deployment, we act as a processor on the customer's instructions. What the system holds by design:

• Audit records of each request: a SHA-256 hash of the request, what was detected, what was decided, and which model was used. The content of prompts and responses is not stored. That is what makes an evidence packet safe to hand to an external auditor.
• Usage records for metering and quota enforcement: counts, tokens and cost per tenant, user and model.
• Account data: the names, work email addresses and roles of the users the customer creates.
• Configuration: regulations enabled, permits, connection details and uploaded templates.

Regulated categories can be pinned to models running on hardware the customer owns, so that content never reaches a third-party provider at all.

4.4Your rights

Where CyberNest is the controller — enquiries, the mailing list, consulting relationships — you may ask for access, correction, deletion or a copy of your data by writing to info@cybernestsec.com. Where we act as a processor for a customer, direct your request to that customer, and we will assist them in answering it.

4.5Retention

Unless the order form states otherwise, hosted deployments retain audit and usage records for 365 days, conversation history for 90 days and uploaded working files for 180 days, with encrypted backups kept for 14 days; each period is configurable per customer. Correspondence about an enquiry is kept for 24 months.

5.1Roles

For customer data in a hosted deployment, the customer is the controller and CyberNest Secure LLC is the processor. For self-hosted deployments CyberNest is neither, holding no customer data. For our own enquiries and business contacts, CyberNest is the controller.

5.2Processing on instructions

In a hosted deployment we process customer personal data only to provide the service and only on the customer's documented instructions, which the order form and configuration constitute. We do not use customer data to train models, and we do not sell it.

5.3Sub-processors

Hosted deployments rely on: Cloudflare for delivery and protection; Microsoft, where a customer enables document delivery to their own Microsoft 365 tenant; and the model providers the customer configures with their own credentials. This is the definitive list. A new sub-processor that will handle customer personal data is announced to the customer contact on record at least thirty (30) days in advance, and the current list is always the one published on this page.

5.4Security measures

• Encryption in transit; tenant isolation enforced on every request.
• Least-privilege access, with connected databases verified read-only before use.
• An append-only audit trail with no application path to update or delete it.
• Content classification before routing, so regulated data cannot leave for a non-compliant destination — and a refusal rather than a downgrade when no compliant destination is available.
• Security monitoring, with findings tagged to OWASP LLM Top 10 and MITRE ATLAS.

5.5Health information

Whether a Business Associate Agreement is required turns on the relationship, not the architecture alone. Where CyberNest hosts the deployment, or otherwise creates, receives, maintains or transmits protected health information on the customer’s behalf, a Business Associate Agreement forms part of the engagement. For a fully self-hosted deployment with local-only routing for PHI, in which CyberNest does none of those things, a Business Associate Agreement may not be required.

5.6International transfers

Hosted infrastructure is located in Puerto Rico, United States, with content delivery and edge protection provided by Cloudflare’s global network. Where a customer’s obligations require data to remain in a specific jurisdiction, self-hosting or local-only routing is the mechanism that guarantees it.

5.7Personal data breach

For hosted deployments we will notify the affected customer without undue delay after becoming aware of a personal data breach, and in any case within seventy-two (72) hours, with the information they need for their own notification obligations.

5.8Return and deletion

On the end of a hosted engagement, customer personal data is exported to the customer and then deleted, except where law requires retention. See clause 2.9.