Security
Your prompts pass through. They never stay.
The gateway reads payloads in memory only while a request is in flight, to count tokens and run loop checks. Prompts and completions are never written to disk, logged or used for training. Click any field to see what happens to it.
Field
Prompt text
"messages": [{ "role": "user", "content": "Review clause 14..." }]- Handling
- streamed
- Retention
- Never written to disk
- Where it lives
- Edge PoP memory only, for the life of the request
- Why
- Read in memory while the request is in flight, to count tokens and run loop checks, then forwarded to the provider. Loop checks use derived signals that cannot be turned back into text. Never written to disk, logged or used for training.
< 5 ms
added latency at the edge
280+
edge points of presence
99.999%
gateway SLA on Scale
SOC 2
Type II report available
Zero Payload Retention
Where a request goes, and what is left behind.
Payloads exist only in process memory for the life of the request. What persists is the metadata cost governance needs.
01
Your app
Calls gateway.palmsouqltd.com over TLS 1.2+ with your tenant headers.
02
Edge PoP, in memory
The payload is read in memory to count tokens and run loop checks on derived signals (hashes, fingerprints) that cannot be turned back into text and are discarded after the detection window.
03
Model provider
The request is forwarded with your provider key, decrypted inside the gateway process only.
04
Regional metering store
Token counts, cost, model, status and timing are written asynchronously to the region you choose.
Fail-open reliability
If we are unreachable, your app is not.
A cost governor must never become the outage. The Python and TypeScript SDKs fall back to the provider directly when the gateway misses its timeout, so a PALM SOUQ incident costs you governance for those calls, not availability.
from palmsouq import governed_client
client = governed_client(
provider="openai",
tenant=account.id,
fail_open=True, # default
gateway_timeout_ms=150, # then call the provider directly
)
# Metering for calls made while failed open is reconciled
# from provider usage when the gateway is reachable again.- 09:14:02.118POST gateway.palmsouqltd.com/v1/chat/completions
- 09:14:02.268gateway timeout after 150 ms
- 09:14:02.269fail_open: POST api.openai.com/v1/chat/completions
- 09:14:03.402200 OK usage in=18,204 out=611
- 09:14:03.403queued usage for reconciliation (1 call)
- 09:16:40.007gateway healthy, governed routing resumed
- 09:16:40.212reconciled 1,284 calls to tenant meters
Controls
The details security reviews ask about.
| Area | How PALM SOUQ handles it |
|---|---|
| Provider API keys | Encrypted in hardware-backed key management (AWS KMS and Cloudflare Secrets), decrypted only inside the gateway process, never returned to a browser or written to logs. |
| Payloads | Zero Payload Retention: read in memory while in flight to count tokens and run loop checks; never written to disk, logged or used for training. |
| Encryption | TLS 1.2+ in transit; AES-256 at rest for metering data. |
| Data residency | Per-workspace region: US, EU or India. Metering data stays in its region. |
| Access | SSO with SAML and SCIM on Scale, role-based access, audit log of every policy change. |
| Compliance | SOC 2 Type II, GDPR with DPA, HIPAA BAA available. |
| Availability | 280+ edge PoPs, 99.999% SLA on Scale, fail-open SDKs, live status at /status. |
Policies, the SOC 2 report and subprocessors are in the trust center. Contract terms are in the DPA and BAA. Uptime by region is on the status page.
Questions, answered
Does PALM SOUQ store my prompts or completions?
No. Under Zero Payload Retention, the gateway reads payloads in memory while a request is in flight, to count tokens and run loop checks. Prompts and completions are never written to disk, logged or used for training. PALM SOUQ stores metadata: token counts, cost, model, status, timing and your tenant identifiers.
How do breakers work without storing prompts?
Loop checks use derived signals, such as a SHA-256 fingerprint of tool name and arguments or a similarity fingerprint of consecutive steps. These cannot be turned back into text and are discarded after the detection window.
What happens if PALM SOUQ is down?
The SDKs fail open: if the gateway does not answer within the timeout you set, calls go directly to the provider. Your application keeps working, and metering is reconciled afterwards.
Where is metering data stored?
In the region you select for each workspace: US, EU or India. Data does not move between regions.
Do you sign a BAA?
Yes. A HIPAA Business Associate Agreement is available, and a DPA covers GDPR processing for every customer.
How do I report a vulnerability?
Email security@palmsouqltd.com. We acknowledge reports within one working day and do not pursue researchers acting in good faith.
Send us your security questionnaire.
We answer standard questionnaires within three working days. Email security@palmsouqltd.com or request the SOC 2 Type II report from the trust center.
14-day free production trial · 100k requests included · no card required