Security

The strongest control we offer is not receiving your data.

Choose the data boundary first: Tileward can run as a hosted service, inside your VPC, or fully air-gapped. In the last two modes, the inference data path stays on infrastructure you control.

Architecture

Pick your exposure.

These are materially different answers to “who can reach this data.” See the complete request path, then choose the boundary that fits it.

Hosted API

Minutes

We hold prompts, context and audit records
Everything on this page applies
Zero infrastructure for you

Your VPC

Days

One node, one GPU
Content, context and audit stay in your account
Your controls, your network boundary

On-prem, air-gapped

Weeks

No network path out
Flat licence, no metering
Audit records retained locally

If your threat model does not permit prompts leaving your network, choose air-gapped.

Governance as a control

A refusal that happens before the model runs.

This is the part of the product that behaves like a security control rather than a feature. More on the governance page.

Nothing off-policy is generated

A request on a locked tile is classified and declined before inference (roughly 14 tokens to decide, and no completion written).

Policy travels with the credential

Rules are bound to the API key, not to a system prompt. A caller cannot drop the policy by changing the prompt, and a leaked key carries only the permissions attached to that key.

Every decision is recorded

Allow and refuse alike: the time, the decision, the tiles it matched, how the match was made, the size of the request, the API key or access token that made it, the actor your client names in its request header, and, where they apply, the policy version in force, the invoking model and the target model. Exportable as CSV or JSON on every account; webhook and SIEM export are Enterprise.

Matching is by tile, not by keyword

A reworded request in the same vocabulary lands on the same tile. Wording that avoids the tile's vocabulary altogether can still pass, so the match follows the vocabulary rather than the concept.