Why I built LLMSec

I'm Waaridh Borpujari, a CS student building LLMSec as a solo founder. The origin of this project is straightforward: I was researching how mid-market fintechs are thinking about LLM governance, and I kept hitting the same wall — there's no tool that produces compliance-ready evidence for SR 11-7 or EU AI Act, and every SaaS scanner has a structural problem for regulated firms: your data leaves your network.

The regulated industry constraint is real, not marketing. If you run a compliance chatbot at a FINRA-regulated broker-dealer and use a cloud-hosted safety scanner to check its outputs, you've just sent customer financial data to a third party that's probably not in your data processing agreement. That's a compliance problem before it's a security problem.

LLMSec's answer is structural: the scanner runs entirely inside the customer's own infrastructure. The on-premise deployment model is not a premium feature — it's the baseline. Everything is built around this constraint, from the offline license verification to the local PDF generation.

I'm currently in discovery mode — running conversations with fintech CISOs and security teams to validate exactly what belongs in the compliance report and what the scanner should prioritize. If you're in this space and want to be a design partner, please reach out. The early conversations have been genuinely useful and I want more of them.

The scanner is open-source ready (MIT-licensable architecture, OSS boundary enforced by CI), though all code is proprietary today. The report engine and compliance mapping framework definitions will always be closed.

This is a bootstrapped project. No VC funding, no team. Revenue from the first license deals will fund the next build. That constraint forces the kind of discipline that produces useful products: you build what the first three customers actually pay for, not what seems interesting.