The model-agnostic LLM safety scanner that runs inside your VPC
Audit-ready compliance reports for SR 11-7 (Fed/OCC), EU AI Act, and NIST AI RMF — without ever sending your model outputs to a third party. Deploy in your environment. Own your data.
Evaluating us? See our measured judge accuracy — calibrated against AllenAI's WildGuardMix benchmark, weaknesses published in full.
Regulators are already asking about your LLMs
FINRA's 2026 Oversight Report flagged LLM governance as an examination priority. SR 11-7 applies to algorithmic systems — including LLMs. EU AI Act GPAI obligations are already enforceable. Every existing tool has the same fatal flaw for regulated firms:
SaaS LLM scanners require you to send model outputs to their servers — a non-starter for regulated data
Platform-locked guardrails (Azure AI Foundry, AWS Bedrock, GCP Model Armor) only work inside their own clouds
No existing tool produces an audit-ready report mapped to SR 11-7 (Fed/OCC) or EU AI Act articles
CISOs need evidence for examiners — not just a pass/fail score
LLMSec is different. It runs entirely inside your environment. We never see your data.
How it works
From deploy to audit-ready PDF in your own infrastructure.
LLMSec runs anywhere Docker runs
Your VPC, your Kubernetes cluster, your air-gapped server. We never see your scan inputs, model responses, or findings. This is the structural guarantee regulated buyers need — not a contractual promise, but an architectural one.
- Docker Compose single-host — up in under 60 seconds
- Helm chart for Kubernetes (coming in Phase 2)
- Air-gapped installation bundle available
- Optional Postgres for enterprise data teams
We publish how accurate our judges actually are.
Most LLM safety vendors claim "99% accurate" with no methodology. We measure every judge against AllenAI's WildGuardMix — 1,720 human-labeled prompt/response pairs — and publish precision, recall, F1, and false-negative rate per category. Including the weaknesses.
SR 11-7 Section 5 and EU AI Act Article 15 both require documented evaluation methodology. This is ours, in full.
What we never see
LLMSec runs entirely inside your network boundary. The list of data we never receive: