01Data plane
Authenticate the caller.
Every governed data-plane request requires a valid workspace API key. Missing, unknown, revoked and expired keys are refused.
Security & deployment
Put every AI call inside a boundary you can explain.
DVARA is an AI gateway that governs model, tool and agent-to-agent calls routed through it. Review where control begins, which behavior you must configure and which responsibilities stay with your team.
AI applicationsAI agentsCoding assistants
Authenticated pathDVARA AI GatewayPolicy · data checks · evidence
ModelsMCP toolsPeer agents
ScopeRouted calls
Data-plane accessAPI key required
PII default actionLOG
Enterprise evidenceHMAC + hash chain
Control on the request path
Security depends on the behavior you configure.
A capability is not an enforcement guarantee. Confirm the action, default and traffic path before treating a control as active.
02Policy and data
Choose the enforcement posture.
Configured policy runs on the request path. PII scanning is on by default, but its default action is LOG, so detected content continues unchanged until you select another action.
03Tools and agents
Set the action boundary.
The Enterprise platform applies configured access, approval and loop controls to MCP tool calls and A2A handoffs routed through DVARA.
Decision evidence
Tamper-evident. Not immutable.
The Enterprise platform persists HMAC-signed, hash-chained audit evidence. Verification can identify supported content changes, broken links and missing signed envelopes.
Prompt storage is off by default. Someone with direct database access can still alter or delete a row, so storage, permissions, backups and retention remain part of your deployment design.
Review the evidence model →01Recorded decisionHMAC signed
02Linked recordPrevious hash
03VerificationChange or gap detected
Deployment boundary
Choose who operates the gateway and where data runs.
The operating model changes infrastructure responsibility. It does not change the need to route traffic through the governed path.
One governed model path.
Run the Apache-2.0 DVARA LLM Gateway with file configuration. It needs no database or Flightdeck. Local HMAC-chained audit recording is optional and requires a file path and secret.
Your VPC, cloud or on-premises environment.
Run the DVARA Gateway, Flightdeck and PostgreSQL under your operational control. Gateways receive signed configuration bundles and spool records to Flightdeck.
A dedicated environment operated by DVARA.
Choose managed hosting when you need the Enterprise platform without operating its infrastructure. Region and commercial terms are agreed in your order.
Enterprise posture
The complete Enterprise platform runs without a key for non-production evaluation within 3 workspaces, 1 account, 1 team and 100,000 governed calls a month. A valid licence removes those limits and grants production rights and support.
Compare deployment and pricing →Identity and access
Separate machine traffic from administrative access.
Applications and agentsWorkspace API keys
Data-plane keys resolve requests to a workspace before configured governance runs.
People and automationFlightdeck authentication
Use built-in authentication, or configure OIDC or SAML SSO. Platform and workspace roles limit the Flightdeck pages a user can reach.
Responsibility boundary
Know what the gateway does not decide for you.
Does DVARA govern a direct call that bypasses it?
No. DVARA governs model, tool and agent-to-agent calls routed through its gateways. Network restrictions and upstream access policy remain part of your deployment.
Does PII detection remove sensitive data automatically?
No. Detection defaults to LOG. Configure REDACT, BLOCK or supported TOKENIZE behavior and test the request, response and streaming paths you use.
Is the audit trail immutable?
No. Enterprise evidence uses HMAC signing and hash chaining. The API is append-only, but direct database access can alter or delete records; verification makes supported changes and gaps detectable.
Does DVARA certify an application as HIPAA or SOC 2 compliant?
No. DVARA provides controls that can support a compliance program. Architecture, identity, retention, operations, contracts and the rest of the control environment remain your responsibility.
Security review
Bring your architecture and one production workflow.
Map the traffic boundary, enforcement settings, evidence path and operational responsibilities with the DVARA team.
Request a security review