Zero-Prompt Persistence & Cryptographic Isolation
Engineered for PromptRelay: Universal Multi-Provider AI Gateway & AWS Bedrock SigV4 Bridge (BYOK) under HIPAA, SOC 2 Type II, and GDPR compliance. Memory ring buffers are cryptographically zeroed on stream completion with Zero-Prompt Persistence.
Zero-Prompt Persistence
All prompt tokens and streaming completions are temporarily stored in ephemeral in-memory ring buffers inside AWS ECS Fargate micro-VMs. As soon as the downstream HTTP connection closes or stream EOF is reached, the memory allocated for the transaction is cryptographically zeroed out (`memset_s`). No prompt data is ever written to swap, local NVMe, EBS volumes, or cold disk.
AWS KMS Envelope Encryption
Tenant API credentials and configuration payloads are protected using AWS KMS Envelope Encryption. The KMS Customer Master Key (CMK) never leaves the AWS KMS Hardware Security Module (HSM). Ephemeral Data Encryption Keys (DEKs) are generated per request, used strictly in memory, and discarded immediately.
TLS 1.3 Strict Forward Secrecy
All traffic traversing CloudFront Anycast and the ECS Fargate ingress layer requires TLS 1.3 with ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) key exchange and AES-256-GCM / ChaCha20-Poly1305 ciphers. Deprecated SSL/TLS 1.0, 1.1, and 1.2 CBC suites are rejected at the edge.
Tenant-Isolated pgvector Partitions
Vector embeddings stored in Amazon Aurora Serverless represent mathematical cosine distance coordinates generated by Amazon Titan Embeddings v2. Embeddings are partition-isolated per tenant with PostgreSQL Row-Level Security (RLS) enforcement, ensuring cross-tenant vector contamination is mathematically impossible.
Enterprise Compliance Alignments
Audited against stringent healthcare, enterprise security, and international data privacy benchmarks.
| Framework / Standard | Scope | Compliance Status | Architectural Safeguards |
|---|---|---|---|
| HIPAA Security Rule & BAA | Business Associate Agreement | Fully Compatible | Supports BAA execution for healthcare workloads. Zero-Prompt Persistence guarantees Protected Health Information (PHI) is never stored at rest, and in-flight PII masking provides automated scrubbing before relay. |
| SOC2 Type II Trust Principles | Security, Availability, Confidentiality | Audit Aligned | Architecture adheres directly to SOC2 Type II trust service criteria. Continuous telemetry logging of gateway operations without recording prompt/completion payload bodies. |
| GDPR Article 28 | Data Processor Compliance | EU Processor Ready | Serves as an encrypted, stateless data processor. Because prompt content is not retained on disk or used for LLM foundation model training, GDPR right-to-erasure requirements are satisfied by design. |
Our security engineering team provides architecture reviews and BAA execution for enterprise cohorts.
CloudFront Edge Shielding, Fargate Micro-VMs & Aurora pgvector
CloudFront Anycast Edge
Global edge presence terminating TLS 1.3 with strict forward secrecy ciphers. Provides automated AWS Shield DDoS mitigation and intelligent regional routing to nearest compute.
- TLS 1.3 Strict Forward Secrecy
- Global Anycast Geo-Routing
- AWS Shield Standard DDoS Mitigation
- HTTP/2 & HTTP/3 multiplexing
ECS Fargate Relay Engine
Containerized relay workers operating entirely in volatile memory. Converts Bearer tokens to AWS SigV4 HMAC-SHA256 signatures and tees SSE streaming tokens to background workers.
- AWS SigV4 in-memory translation
- Asynchronous stream-teeing engine
- Volatile RAM ring buffers (zero disk)
- Per-tenant token FinOps rate limiting
Aurora pgvector & KMS Vault
Amazon Aurora Serverless PostgreSQL with pgvector HNSW indexing for high-speed semantic matching. Provider API keys are decrypted via AWS KMS envelope encryption exclusively in volatile RAM.
- Amazon Titan Embeddings v2
- Aurora pgvector HNSW cosine search
- AWS KMS Envelope Key Encryption
- Tenant-isolated row-level partitions
Request Security Package & Custom BAA
Direct Technical Lead Inquiry
Dedicated Routing Channels
Enterprise Sandbox
enterprise@kiyaslabs.techProvisioning for enterprise subscriptions, dedicated VPC relays, and HIPAA BAAs.
Developer Support
support@kiyaslabs.techInquiries regarding the AWS SigV4 translation bridge, OpenAI SDK drop-in, or stream-teeing.
Security Disclosures
security@kiyaslabs.techEncrypted PGP channel for vulnerability reporting, pen-test reports, and compliance reviews.
Operating Entity for PromptRelay™ • Response SLA: Within 1 Business Day