Architecture

A layered AI security platform, deliberately split between enforcement and operations.

This split matters for both engineering and procurement. The runtime is your AI firewall: a layered deterministic, then ML, then LLM-judge engine behind a fail-closed gate that enforces where your application runs. The control plane handles policy workflow, compliance evidence, and operations only when your team needs that layer. Detection and inference can stay entirely inside your boundary.

Runtime AI firewall

Self-hosted on every plan

The data plane is the enforcement layer. It runs a layered deterministic, then ML, then LLM-judge engine behind a fail-closed gate, evaluating every prompt, response, tool call, and agent step inside your environment. It runs with or without the console.

Lives in your infrastructure and never sends traffic out to enforce
Layered engine with a fail-closed gate and 40 detectors across prompt injection, PII, secrets, toxicity, malicious URLs, insecure code, and hallucination
Input, output and DLP egress, tool, streaming, and agentic stages: retrieval, agent plan, agent step, and memory write
Optional in-boundary inference sidecar so ML and judge models run inside your VPC and data stays within your boundary

Control plane

Growth / Enterprise

The operations layer is where policies, evidence, traces, and team workflow are coordinated. It holds compliance scorecards, model cards, benchmarks, and drift signals when you need more than local files.

Hosted by ZNYX in Growth
Optionally self-hosted in Enterprise, including fully air-gapped
Coordinates policy workflow, OWASP LLM Top-10 coverage, detector scorecards, and release safety signals

Request flow

Your application sends a prompt, response, tool call, or agent step to the runtime.
The runtime resolves the policy for the given tenant, app, agent, and environment scope.
The layered engine runs deterministic detectors first, then ML scorers, then LLM-judge checks as needed, with the inference sidecar serving ML and judge models inside your boundary.
The fail-closed gate returns an allow, block, redact, warn, or transform decision.
Your application calls the model only after the input check passes.
Model output is evaluated again through the DLP egress gate, including for agentic and MCP stages like retrieval, agent plan, agent step, and memory write, before anything reaches the end user.

What belongs to the runtime AI firewall and what belongs to the control plane.
Responsibility	Runtime	Control plane
Runs in customer infrastructure	Yes	Optional in Enterprise only
Enforces on live traffic	Yes	No
Runs the layered detection engine and fail-closed gate	Yes	No
Stores local policy files	Yes	No
Coordinates policy workflow	No	Yes
Holds compliance evidence and scorecards	No	Yes
Provides operational traces	Emits events	Stores and organizes them
Required to enforce policy	Yes	No

Architecture note

Growth is a self-hosted runtime firewall plus a hosted control plane. Enterprise keeps the same layered architecture but gives you the option to place the control plane inside your boundary as well, up to a fully air-gapped deployment.

Compare Plans Deployment Patterns

A layered AI security platform, deliberately split between enforcement and operations.

Runtime AI firewall

Control plane

Request flow

Architecture note

Secure every prompt, agent, and tool call, in your boundary.