# Trust boundaries

Data handling, persistence, and security posture for enterprise diligence.

## What leaves the client

When `blekline_mask_prompt` is called, the text payload is sent over HTTPS to `/api/mask` on the Blekline control plane, then forwarded to Azure Cognitive Services (Text Analytics PII detection). The response returns `maskedText` and a `tokenMap` — original entities are not stored in persisted event records.

When `blekline_evaluate_tool_call` is called, the tool name and argument summary are evaluated locally via `@blekline/contracts`, and optionally checked against the workspace policy API. Full argument bodies are not stored in default event ingest.

## What is stored in audit events

Audit events in workspace Activity contain **metadata only**:

| Field | Example |
|-------|---------|
| `kind` | `tool_call_enforcement` |
| `action` | `allow` / `mask` / `block` |
| `entitiesMasked` | `3` |
| `riskTier` | `low` / `medium` / `high` |
| `mcpToolName` | `write_file` |
| `clientSurface` | `cursor`, `continue`, `github-copilot`, `openhands`, `sourcegraph-cody`, etc. |
| `modelProvider` | `anthropic` / `openai` |
| `requestId` | UUID for correlation |

No raw prompt text. No full tool argument bodies. No user-identifiable content in default configuration.

## Data residency

- SaaS: `app.blekline.com` — **EEA-first by default** (Frankfurt compute, Ireland database, Germany West Central cloud mask). See [Subprocessors](https://blekline.com/subprocessors).
- **US-primary hosting:** available on enterprise program with signed US Processing Addendum. Contact sales with `dataResidency=US`.
- Edge sidecar with `BLEKLINE_MASK_FAST_PATH=local_only`: no data leaves the sidecar.

## Encryption and tokens

All API traffic: TLS 1.2+ in transit. Workspace tokens are scoped (`mask:write`, `events:write`), rotatable, and never logged in event records. Rotate tokens quarterly — see [SSO & deployment](/docs/enterprise/sso-deployment) hardening checklist.

## Certifications

SOC 2 Type II: on the roadmap. Contact enterprise sales for current timeline and to request a security questionnaire.

## Third-party eval (LangSmith)

[LangSmith](/docs/integrations/langsmith-stack) receives **metadata-only** exports when you forward `/api/events` or OTel labels — not prompt bodies by default. LangSmith is an eval platform, not a SIEM. For compliance archives use [Enterprise telemetry](/docs/enterprise/telemetry).

## Claim integrity (shipped vs roadmap)

Every capability claim in sales and marketing maps to one of these labels:

| Capability | Status | Notes |
|------------|--------|-------|
| MCP mask + tool enforce | **Shipped** | `blekline_mask_prompt`, `blekline_evaluate_tool_call`, MCP proxy |
| Cursor IDE hooks | **Shipped** | Chat mask, read/shell/tool/MCP guards via `@blekline/cursor-hooks` |
| Cursor Cloud Agent hooks | **Partial** | Shell + preToolUse + read; no chat-submit or MCP-exec hooks (Cursor platform) |
| Ingress request mask/block | **Shipped** | `/api/ingress/v1/chat/completions`, `/api/ingress/v1/messages` |
| Ingress response mask | **Shipped** | Assistant content redacted on ingress proxy return path |
| Activity audit + CSV export | **Shipped** | Metadata-only events in workspace Activity |
| SDK mask + enforce | **Shipped** | Python/TS client, `/api/mask`, `/api/mcp/enforce-tool-call` |
| SIEM forward (JSON/CEF) | **Shipped** | Governance+; HTTPS webhook with probe |
| NHIM Trust Vault (sidecar) | **Shipped v1** | VPC sidecar; encrypted vault; hydrate in-cluster only |
| NHIM Lineage Firewall | **Shipped v1** | Destructive tool block on contaminated sessions |
| SAML SSO | **Enterprise program** | OIDC via dashboard today; SAML on roadmap |
| Extension exfil block/warn | **Not shipped** | Telemetry only (`exfil_signal`) |
| Full cross-SaaS DLP | **Enterprise program** | Not CASB replacement |
| SOC 2 Type II | **Roadmap** | Contact sales for questionnaire |

## What Blekline is not

Blekline is **NHIM + AI runtime enforcement** at the agent boundary (open-core MCP wedge + private runtime engine). It is not:

- A WAF or network-level firewall
- A full CASB/DLP system (it operates at agent, MCP, and API boundaries — not network packets)
- A model routing marketplace

Ingress governs prompts and tool calls **before** models and tools. Response mask on the ingress proxy redacts sensitive content in model outputs **before** they return to your agent runtime. Forward audit metadata to your SIEM via `/api/integrations/siem` (Governance+).

This scope boundary is intentional. See [Architecture](/docs/introduction/architecture).

---

**Next steps:** [MCP identity pinning](/docs/security/mcp-identity-pinning) · [Enterprise telemetry](/docs/enterprise/telemetry) · [EU AI Act mapping](/docs/introduction/eu-ai-act)