Security
Security by architecture, not by promise.
The strongest control is the one that cannot be bypassed. Moderniser never holds your source, so most of the question “is your cloud safe for our code?” has no referent.
What we do hold, held properly
Connector credentials
SAP and Dynatrace credentials are encrypted at rest with AES-256-GCM and decrypted only in memory when a connector makes a call. They are never logged and never returned.
Tenant isolation
Every query is scoped by company, as a database boundary — not a filter the application remembers to add. A record that is not yours answers 404, never 403: existence itself is not disclosed across tenants.
Tokens and sessions
API tokens are stored hashed; the plaintext exists once, at creation. The agent authenticates with a token that can be revoked independently of your login.
Metering you can audit
Usage is priced from the inference gateway's own record — the one component that physically sits on every model call — not from a client's claim about what it did.
Have a security questionnaire? Send it.
Book a demo and we will walk your team through the architecture, or answer the questionnaire directly.