FAQ

What is Sentisec?

Runtime security for AI agents. Sentisec sits between your agent and your model provider, evaluates every call in the context of the session it belongs to, and stops the ones where the agent is acting on instructions it should not be following. Everything it evaluates is recorded as auditable evidence.

Your agent code does not change. You change a base URL and an API key.

Who is it for?

Teams running AI agents in production — particularly agents that browse, read documents, touch customer data, or hold credentials that can change something. It is also for teams preparing for EU AI Act Article 12, the NIST AI RMF, or a SOC 2 programme that now has AI controls in it, because those all ask for evidence and Sentisec produces it as a by-product of doing its job.

What providers can I route through it?

Six, today: Anthropic, OpenAI, Amazon Bedrock, Kimi (Moonshot), Google Gemini, and Google Vertex AI. There is also a passthrough path for CLI coding tools that authenticate with a personal subscription rather than an API key.

Azure OpenAI and self-hosted OpenAI-compatible servers are not available yet. If one of them is a requirement for your deployment, tell us — it moves the priority. Get in touch.

See Providers for setup guides.

What clients and frameworks work with it?

Anything that speaks the Anthropic Messages or OpenAI Chat Completions format, which is most of the ecosystem: the OpenAI and Anthropic SDKs, LangChain, LangGraph, PydanticAI, LlamaIndex, CrewAI, and CLI coding tools including Claude Code, Codex, Cursor, and OpenCode. Sentisec also publishes its own SDKs — sentisec-sdk on PyPI and @sentisec/sdk on npm.

See Integrations.

Does my agent break when Sentisec blocks something?

No, and this is the design point most worth understanding. Sentisec never returns an HTTP error when it stops a tool call. It returns a valid response in your provider's own format, with the blocked call removed and a plain-language explanation in its place. The run ends cleanly with that explanation as its answer. If you would rather the model re-plans, a workspace admin can opt in to a mode where supported frameworks hand the model Sentisec's reason and the run continues.

What happens when a tool call is blocked has the exact shapes and the supported frameworks.

Can I try it without it affecting my traffic?

Yes — that is what shadow mode is for. The engine evaluates every call and records the truthful verdict, but responses are released untouched. Run it for a week against real traffic, look at what would have been stopped, tune, then switch to enforce.

Do you train on my data?

No. Your traffic is never used to train models, ours or anyone else's, and it is not shared with third parties beyond the provider you asked us to call.

Be aware of the flip side: on the hosted service, prompts and responses are stored by default, because that is what makes a flagged session reviewable. If you do not want bodies retained, switch your workspace to metadata-only capture, or shorten the retention window. Security covers exactly what is stored and for how long.

Is Sentisec open source?

The platform is closed source. The SDKs — sentisec-sdk and @sentisec/sdk — are Apache-2.0. The product source is available to vetted clients under NDA; request access.

Hosted or self-hosted?

Hosted is the default: sign up, connect your provider credential, mint a key, route your agent at api.sentisec.ch. Nothing to run.

Self-hosting — in your own VPC, on-premise, or air-gapped — is an enterprise arrangement, for data-residency requirements and regulated verticals. See Deployment and Enterprise.

What does it cost?

There is a free tier with a monthly allowance of 1,000 monitored sessions, which is enough to evaluate Sentisec properly against a real agent. Paid plans scale the session allowance and the per-minute request rate. The enterprise tier covers in-VPC deployment and the controls that go with it.

For current pricing, email [email protected].

What does a verdict look like?

Four verdicts, four interventions. Every evaluated call gets one of each.

HALT and ABORT are the two that stop a call. Non-nominal verdicts also produce a signed, hash-chained evidence bundle an auditor can verify independently.

What about latency?

Sentisec adds one network hop plus the evaluation on the request path. The deeper checks run asynchronously and never hold up your call. In practice the dominant term is the same one it was before — your provider's own response time and your network path to it.

We publish measured numbers rather than estimates, so if you need a latency figure for a specific deployment shape, ask us for it against your own traffic.

How is this different from a content filter?

A content filter reads the text. Sentisec reads the session — what the agent was asked to do, what has entered its context since, where that came from, and whether the action it is about to take follows from the task or from something it read along the way.

A hijacked agent usually produces perfectly innocuous-looking text and a genuinely harmful action. Filters miss that by construction. See Comparison.

What happens if Sentisec itself has a problem?

Two behaviours are deliberate. A workspace whose protection setting cannot be read resolves to enforce, never to open — a failure on our side never leaves you unprotected. And in CLI subscription mode, an internal error in the evaluation path fails open so your coding tool keeps working rather than hanging. Authentication failures are never treated that way.

How do I start?

Sign up at app.sentisec.ch, connect a provider credential, mint a Sentisec API key, and point your agent at your workspace-scoped base URL. The Quickstart takes a few minutes; the dashboard tour takes a few more.