Security
Last reviewed: July 21, 2026
IQ Routing handles two of the more sensitive data classes a buyer cares about: the prompts that leave the building, and the provider keys that pay for them. Each control below carries its status before the description: what is live in production today, and gateway PII redaction, which is on our roadmap.
Live today
Encryption Live today
Provider keys are encrypted at rest under authenticated encryption on every path. The per-request credential store the gateway reads on each routed call uses Fernet authenticated encryption (AES-128-CBC with an HMAC integrity tag); the row is decrypted once per request and the cleartext key is never serialised back to disk and never reaches React state outside the upload modal. The key-vault reveal path, which lets an operator recover a key through a step-up-authenticated flow, uses AES-256-GCM envelope encryption keyed off a master key that is held in secret storage outside the application, injected at runtime, and never written to the gateway's process logs. Every connection between the gateway and its own storage runs over TLS, and none of that storage is reachable from the public internet; it is only addressable from inside the gateway's private network.
Audit log Live today
Every state-changing mutation across orgs, teams, providers, keys, alerts, trial grants, and ERP connections writes a row into your org's audit log with the user identifier, the action name, the prior state, the new state, and a timestamp. The log is append-only; rows cannot be edited or deleted from the dashboard. Each row is also hash-chained to the one before it, so an edit or a deletion anywhere in the history breaks the chain and the verifier reports exactly where. CSV export streams uncapped via cursor pagination so a 90-day export cannot abort mid-stream.
Authentication Live today
Production sign-in runs on a dedicated managed identity provider, which issues the session and manages credentials. That identity is carried into the gateway over an HMAC-verified trust boundary, so a session cannot be forged on the way across. The signed iq.active_org cookie carries the active-org selection; tampering invalidates the cookie.
Access enumeration mask Live today
Every admin endpoint returns 404 rather than 403 for resources outside the caller's org. The mask prevents an attacker from probing org IDs via the API surface. The single-point-of-truth helper applies the mask to every admin path; the inheritance is automatic on any new endpoint.
Per-statement query timeouts Live today
Every storage call from the critical-path admin endpoints carries a per-statement timeout (one to ten seconds depending on the endpoint's expected work). A slow query cannot starve the connection pool or hold a transaction open long enough to block other requests.
Zero data retention Live today
Zero Data Retention is an org-level setting on every plan, including Free, with an enablement timestamp stamped server-side when you turn it on. With it on, payload logging and telemetry content retention are disabled and locked: request and response bodies are never persisted, an attempt to arm payload capture while it is on is rejected rather than quietly honoured, and the routing judge's free-text reasoning is withheld from telemetry too. Conversation state on the stateful API still exists, because that API cannot work without it, but it is TTL-bounded, expiring after 24 hours idle by default, and an org-level erasure clears it immediately. Response caching keeps running under your own configuration, org-isolated and short-lived. Metadata rows, meaning timing, token counts, cost, and which model was chosen, are still written, because billing and the usage page run on them. The authoritative version of this boundary, written for a security reviewer, is on the security documentation page.
SOC2 evidence pack Live today
Enterprise owners and admins generate the pack on demand from the Audit pane in the dashboard. The export builds a ZIP from the append-only audit log and access-control matrix, with the chain-of-custody columns intact, so your own auditor can re-verify the chain offline. This is evidence-pack tooling for your audit: IQ Routing is not claiming SOC2 Type I or Type II certification, and does not represent that it has completed a SOC2 audit, unless a report is separately provided to you under NDA. Questions? Email support@iq-routing.com.
Roadmap
Gateway PII redaction Roadmap
PII redaction of prompts at the gateway boundary is on the roadmap and is not live at the request boundary today. Until it ships, the gateway does not strip identifiers from prompts before they reach upstream providers. Treat upstream providers as recipients of the payloads you send, and do not route protected health information (PHI) or regulated sensitive personal data through IQ Routing unless your team has a signed agreement and confirmed controls in place.
Reporting a vulnerability
Email security issues to security@iq-routing.com. We acknowledge within one business day and triage within five. Our machine-readable disclosure policy is published at /.well-known/security.txt.