Enterprise Security Architecture

Your Data. Your Rules.

Agentis is engineered with zero-trust principles. No proxying of LLM API calls, optional zero-payload modes, and automatic client-side PII redaction.

Trace Ingestion Modes

Choose the telemetry posture that aligns with your enterprise compliance standards

Metadata-Only Mode

Maximum Privacy & Banking Grade

In metadata-only mode, prompt text, user inputs, and model outputs never leave your application pod. Agentis only receives span execution times, token volume counts, model identifiers, and exact cost calculations.

Prompt / Output Ingestion:0% (Never Sent)

Token & Cost Calculation:100% Span-End Accurate

Agent Registry & Health:Fully Supported

secure_init.py

from agentis import init

# Enable Metadata-Only Mode: Zero prompt or payload data ever leaves your VPC
init(
    project="classified-financial-agent",
    mode="metadata_only",      # Only emits tokens, latencies, error codes, and cost
    redact_pii=True            # Additional regex defense-in-depth masking
)

Security by Design Pillars

Built from the ground up for strict enterprise information security policies

NO PROXYING

Direct Provider Calls

Agentis never sits as a man-in-the-middle proxy between your application and AI providers like OpenAI or Anthropic. Your SDK connects directly to foundation models.

PII SCRUBBING

Client-Side Masking

With init(redact_pii=True), names, credit cards, SSNs, and phone numbers are scrubbed locally in memory before OTLP trace export.

ZERO CREDENTIAL EXPOSURE

No Secrets in Logs

Agentis automatically scans HTTP headers and environment variables to strip API keys, bearer tokens, and session identifiers from trace payloads.

ENCRYPTION

TLS 1.3 & AES-256

All telemetry data is encrypted in transit via TLS 1.3 and at rest with AES-256. Dedicated KMS keys are supported on Enterprise deployments.