How does ZDR work with requests that trip security measures in the model provider? Do the providers retain those requests for analysis or is that too guaranteed?
This is great, question though, since you support coding agents like Claude Code and Codex, they run MCP servers, plugins, web search/fetch and their own telemetry from the dev's machine. Do you give customers guidance or controls for that side, or is it out of scope for the gateway?
Food for thought, tool and MCP calls run locally, but every request carries the tool list and every response carries the model's tool calls, both of which pass through you. You could strip non-approved tools from the request and block calls to them in the response, based on an org allowlist. That gives you org-approved MCP/tool calls without touching the dev's machine.
Correct. We have contractual agreements to ensure no data that passes through our platform will be used for model training purposes. In addition, we have in our contracts that we (Consus) will also not use any data for training purposes. We couldn't if we wanted to since we do not store any prompt data.
How does ZDR work with requests that trip security measures in the model provider? Do the providers retain those requests for analysis or is that too guaranteed?
This is great, question though, since you support coding agents like Claude Code and Codex, they run MCP servers, plugins, web search/fetch and their own telemetry from the dev's machine. Do you give customers guidance or controls for that side, or is it out of scope for the gateway?
We do give our customers guidance to make sure they are thinking about this properly. This typically happens during on-boarding.
We also built out pre-defined controls for common tools so they can click a button and not think about it.
Food for thought, tool and MCP calls run locally, but every request carries the tool list and every response carries the model's tool calls, both of which pass through you. You could strip non-approved tools from the request and block calls to them in the response, based on an org allowlist. That gives you org-approved MCP/tool calls without touching the dev's machine.
Does this work with HIPAA data ?
I love this. Will this guarantee that proprietary/ sensitive/ CUI data won't leak to model training or other parties?
Correct. We have contractual agreements to ensure no data that passes through our platform will be used for model training purposes. In addition, we have in our contracts that we (Consus) will also not use any data for training purposes. We couldn't if we wanted to since we do not store any prompt data.