Interdict is a runtime enforcement layer between your application and supported model providers. The trust model is intentionally concrete: visible policy, explicit destinations, minimized audit content, encrypted provider credentials, and fail-closed handling where verification cannot be completed safely.
This page describes current technical behavior—not a certification, not a compliance guarantee, and not a substitute for your organization's own security, privacy, or legal review.
Interdict inspects supported request and response text for email addresses, US phone numbers, Social Security numbers, explicitly labeled dates of birth, and Luhn-valid payment cards, then applies the configured policy action.
Per-type policy can block, redact, or allow model exposure and can route approved SSN/DOB verification context to a configured external verifier while withholding the protected identity envelope from the model payload.
Customer-supplied provider credentials are encrypted at rest with AES-256-GCM and are used server-side to forward authenticated provider requests after the applicable request checks complete.
Audit events record request identity, application and policy version, provider/model, detector outcome, status, and latency without storing raw prompt or response content in the ordinary audit record.
Sensitive-data verification is an external security action, not a model capability. Raw verification context is kept out of the supported model payload and is only sent to a configured verifier when policy requires it.
We can walk through request ordering, verification routing, response inspection, streaming, audit fields, credential handling, budgets, and alert delivery against the controls your team needs to assess.