Security & Data Governance
How AgentMink safeguards customer payloads, encrypts BYOK credentials, and guarantees stateless zero-retention processing at the Anycast edge.
The Zero-Retention Request Lifecycle
Every prompt payload passes through an ephemeral, volatile memory pipeline that permanently terminates upon client connection close.
Anycast Ingress
Client request connects to the nearest Cloudflare Anycast edge node over TLS 1.3 encryption with strict cipher negotiation.
In-Memory Auth
API token validity and daily spend caps are verified concurrently in volatile isolate memory in under 1.2ms.
In-Flight Key Injection
Your BYOK credential is decrypted strictly in volatile RAM and attached to the upstream foundation model dispatch request.
Zero-Buffer Stream & Purge
SSE response chunks are piped directly to the client without buffering. The V8 isolate memory is wiped immediately on stream close.
Core Security Domains
Architectural controls designed to meet the compliance and risk standards of healthcare, fintech, and enterprise engineering teams.
BYOK Key Vault Cryptography
Your foundation model credentials never leak into client-side bundles or public endpoints.
- Authenticated Encryption: Stored at rest using AES-256-GCM with distinct per-workspace cryptographic nonces.
- Volatile Edge Decryption: Keys are decrypted solely within ephemeral V8 worker isolates during upstream dispatch.
- Zero Plaintext Storage: API secret keys are never exposed in UI inspection views or plaintext database columns.
Network & Edge Protection
Multi-layered edge perimeter defenses guard against DDoS attacks, automated scraping, and noisy neighbors.
- Anycast DDoS Mitigation: Cloudflare edge perimeter absorbs Layer 3, 4, and 7 volumetric traffic spikes.
- Sub-Millisecond Spend Caps: Instant HTTP 402 circuit breakers halt runaway agent loops before incurring unexpected cloud charges.
- Isolated Origin Routing: Backend database and KV infrastructure remain non-public and accessible solely via encrypted private bindings.
Privacy & Compliance Frameworks
Engineered for global data protection compliance with strict statutory alignment.
- GDPR & UK DPA 2018: Article 17 Right to Erasure satisfied natively through zero persistent payload retention.
- California CCPA/CPRA: Explicit “Do Not Sell or Share” commitment and Global Privacy Control (GPC) support.
- Standard Contractual Clauses: SCCs integrated directly into enterprise Data Processing Addenda (DPAs).
Telemetry Minimization
Zero prompt inspection or completion logging. We only ledger non-PII operational telemetry.
- Non-PII Metadata Only: We record only token counts, execution latency (ms), model family ID, and HTTP status codes.
- Non-Blocking Execution: Usage ledgering runs via asynchronous
waitUntil()routines without adding TTFT latency. - Zero Model Training: Your prompts and completions are never utilized, retained, or sold to train foundation models.
Authorized Sub-Processors
AgentMink engages vetted enterprise infrastructure providers to deliver global edge proxy and billing services.
| Sub-Processor | Role / Purpose | Data Handled | Location |
|---|---|---|---|
| Cloudflare, Inc. | Anycast Edge Compute, Workers Isolates, DDoS Mitigation | Ephemeral in-memory HTTP traffic in transit | Global (300+ PoPs) |
| Stripe, Inc. | PCI-DSS Level 1 Subscription Payment Processing | Billing details, card tokens, invoice history | United States |
| Configured AI Providers (OpenAI, Anthropic, Google, DeepSeek, Groq, Bedrock) | Foundation Model Inference Execution (Direct BYOK) | Prompt payloads and completion streams under your direct vendor agreement | United States / Global |