DragonLairSecurity
How DragonLair protects tenant access, credentials, and governed inference.
Security controls
- Tenant-scoped credentials — project API keys and BYOK secrets stay organization/project scoped; portal mutations remain server-gated.
- Fail-closed unsupported fields — unknown or unsupported request fields are rejected rather than silently accepted where the compatibility matrix requires it.
- Guardrails — deterministic PII and secret redaction plus prompt-injection rules on the chat path.
- Governance before optimization — budgets, virtual-model policies, and explainable governance headers bound the action space before ranking.
- Separated authentication — customer inference uses API keys or JWT on
/v1; portal session cookies do not authorize inference. - Emergency revoke surfaces — tenant and portal emergency revoke paths exist for scoped credential invalidation where configured.
Assurance and availability
- Certification and contractual assurance details are provided only when included in a signed enterprise agreement.
- See operational status for current service health.