Security

Your data stays on your server

Data	Where	Protection
Prompts and answers	Pass through the gateway to your providers; request logs in ClickHouse on your server	Never sent to NuRoute. PII redaction policies can remove personal data before it reaches a provider
Provider API keys	PostgreSQL on your server	Encrypted (AES-256-GCM) with PROVIDER_ENCRYPTION_KEY from your .env; never shown again after saving
NuRoute API keys	PostgreSQL	Only a SHA-256 hash is stored; the key is shown once when created
Passwords	PostgreSQL	bcrypt hashes
Licence key, mail server password	PostgreSQL	Encrypted with AUTH_ENCRYPTION_KEY

Only Caddy listens on the network (ports 80 and 443). The databases and internal services are reachable only by each other, on an internal Docker network.

The one connection to NuRoute is the licence check-in.

Images you can check

NuRoute's images are public, and every release is:

• scanned before publishing: no vulnerability rated critical with a fix available, and no secrets anywhere in the image;
• audited to contain only compiled NuRoute code and its dependencies: no source code, tests, data or training material;
• signed with cosign by NuRoute's release pipeline, with each signature recorded in the public Sigstore transparency log;
• shipped with a signed SBOM (software bill of materials, SPDX) per image and platform, listing every package in it.

To verify an image yourself, install cosign and run (with the image and version you use):

cosign verify ghcr.io/nuroute-ai/api-gateway:1.0.0 \
  --certificate-oidc-issuer https://gitlab.com \
  --certificate-identity-regexp '^https://gitlab\.com/amitgupta2108/aiinferencecontrolplane//\.gitlab-ci\.yml@refs/tags/selfhosted-v[0-9]+\.[0-9]+\.[0-9]+$'

It prints the verified signature as JSON, or fails with no matching signatures if the image was not signed by NuRoute's release pipeline. The SBOMs are attached to each GitHub release; to verify one attached to an image, use cosign verify-attestation --type spdxjson with the same options.

Updates are signed too

The routing model and model catalog your install receives with the check-in are signed with a separate NuRoute key that never leaves our build pipeline (not even our licence server holds it). Every NuRoute service verifies the signature before using an update.

Your responsibilities

You run the server, so these are yours:

• Keep the operating system and Docker updated (security updates).
• Keep NuRoute on a supported release: the last two minor versions, or 12 months. Upgrades take one command (Backups and upgrades).
• Restrict who can log in to the server and read .env: anyone who can run docker on it controls NuRoute.
• Back up daily and keep the backups off the server, as carefully as .env itself.

Reporting a vulnerability

Email security@nuroute.ai, not a public issue. We answer within 2 business days, and ship fixes for critical vulnerabilities as patch releases within days for every supported release.