Security & Compliance

Mappace is a self-hosted LLM gateway. You own the infrastructure, the data, and the compliance posture. Below is what the platform does out of the box — the engineering controls an auditor would look for.

At a glance

Standard

SOC 2 Type II aligned (self-attested controls)

Data residency

Self-hosted — data stays in the operator's own PostgreSQL + Redis

Request log retention

90 days

Audit log retention

365 days

SSO

Optional

What we collect

Account email + bcrypt-hashed password
API requests (model, token counts, latency, cost) — prompt/response text logged for admin review only
Admin audit events (who did what, when)

What we never do

No reselling of prompts to third parties
No training on customer data
No advertising profiles

Sub-processors

Operator-configured LLM providers (requests forwarded only with user consent)
Redis (ephemeral rate-limit + cache state)
SMTP relay (transactional email, if configured)
EasyKash (payment processor, MENA; no card data stored by us)

Access controls

Role-based admin (owner > admin > member > user)
Org-scoped data isolation
SSO enforcement (optional, operator-configurable)
All privileged actions recorded in an append-only audit log

Your rights

Right to export account data
Right to deletion (operator-enforced retention windows)
Right to disable prompt/response logging

Encryption

Provider API keys encrypted at rest (AES-256-GCM via operator key)
JWT-signed sessions (HS256)
TLS in transit (operator-terminated)

Retention windows are operator-configurable and auto-enforced by deletion jobs.