The AI Trust Proxy

One Question on Every Call

Every company is wiring AI into its products with nothing between the model and the rest of the software.

Prompts get injected by the documents they summarise. Replies carry keys and card numbers out of the building. Agents call tools nobody signed off. The AI Trust Proxy sits between your software and the model and answers one question on every call: can this be trusted?

What It Checks

1. 1Inbound

   the prompt, before it reaches the model

   Prompt injection: instructions to ignore the operator, fake system messages and control tokens, asks to reveal the hidden prompt, notes addressed to the AI inside a document, encoded payloads, requests to send data elsewhere. Thirty-seven signatures; blocked, flagged or sanitised as you choose.

2. 2Outbound

   the reply, before it reaches your user

   API keys from OpenAI, Anthropic, AWS, GitHub, Slack, Google and Stripe, private keys, JSON web tokens, passwords in configuration, connection strings, payment cards (checked against their checksum), UK National Insurance numbers, and any pattern of your own. Redacted or blocked before it leaves.

3. 3Policy

   the call as a whole

   One JSON file says which models may be used, which tools the model may be offered or may call, and how many tokens one call may spend. Anything outside it stops, and the log says why.

Install

One container. Change one line in your app: the model's base address becomes the proxy's.

docker run -p 8080:8080 \
  -v "$PWD/policy.json:/policy.json" \
  -v proxy-data:/data trust-proxy

OpenAI-format calls go to /v1/chat/completions, Anthropic-format calls to /v1/messages. Your API key travels in your own header; the proxy forwards it and never stores it.

{
  "models_allowed": ["gpt-4o*", "claude-*"],
  "max_tokens_per_call": 8000,
  "tools_forbidden": ["send_email", "transfer_*", "delete_*"],
  "injection": { "action": "block", "sensitivity": "medium" },
  "leakage": { "action": "redact" }
}

That is the whole policy. Everything you leave out is not enforced.

Measured, Not Claimed

• 50 / 50known injection attacks blocked
• 50 / 50ordinary requests let through
• 24 msto scan a 12 KB prompt on one core

The test corpus ships with the code and runs on every build; the build fails if fewer than 45 attacks are caught or any ordinary request is blocked. Figures from the run of 31 October 2026. The same input always gets the same verdict, so a decision can be reproduced and argued with.

On Your Machines

The companies that need this will not send their prompts to a third party. So the proxy runs where your software runs, keeps its log there, and sends nothing to us. The source ships with every installation, in C++, small enough to read in an afternoon.

The log keeps the time, the model, a hash of the prompt, the latency, the verdict and the rules that fired. Prompt and reply text are kept only if your policy says so.

What the Rules Teach

The first version is deterministic on purpose: rules, patterns and checksums, with no model in the loop and no surprises. What those rules catch, across every installation that chooses to share it, becomes the curated training data for da Vinci, so the next version catches what the rules cannot describe. That is the one place our two focuses meet.