Customer-controlled by design. Clear about our limits.
How AI Data Masking keeps your data on your side, how execution control is designed and verified, and what Herkus does and does not claim.
Raw sensitive values stay on your side.
Herkus configures, deploys and validates the protected path inside your VPC. Original sensitive values, credentials, mappings and audit records remain under your control; Herkus does not receive or independently process customer production data.
- Raw business text
- Protection policies
- Model credentials
- Protected-value mappings
- Validation and restoration
- Audit evidence
MASKED
CONTENT
- Protected prompt content
- Required task context
- Protected entity references
- Model-generated response
Only masked content is sent to the AI provider selected by the customer. Where restoration is required, it happens inside the customer-controlled path after validation.
Control stays outside the model.
The same system being controlled should not be the only system deciding what may be disclosed or restored.
Before the model
Customer-specific protection runs before content reaches the external AI provider.
Before restoration
The returned result must pass the configured validation path before protected values are restored.
Inside your boundary
Credentials, mappings and evidence remain in the environment controlled by the customer.
A response arriving is not enough.
The customer-side masking path checks whether a returned result belongs to the active call and remains eligible for restoration under the configured policy. Invalid, expired or replaced results stay masked.
Result received
The external model returns masked content.
Execution checked
The result is evaluated against the active call.
Policy applied
Restoration eligibility is determined.
Restore or reject
Only eligible values are restored.
Safety properties.
What Execution Guardian and Execution Gateway are designed to do.
Stay safe when unsure
An unknown outcome or a missing decision never becomes permission.
Unknown is held
An uncertain effect is contained before the same effect can be attempted again.
Outdated executions rejected
Replaced or cancelled executions cannot act, even if their credentials still work.
Resolved by evidence
Unknown outcomes are resolved from the target system's evidence, not by trying again.
Built for faults
Designed so that decisions and effect facts survive process and database restarts.
Evidence recorded
Decisions and effect facts are recorded so that what was approved, what was done and what happened can be reconstructed.
What Herkus does, and does not, claim.
Configured to your requirements
Herkus configures technical protection and execution control according to agreed customer requirements. Customer teams decide which data, processing and actions are permitted for their business.
Evidence supports review
Technical evidence supports review but does not replace legal or regulatory assessment. No product can remove every data, security or compliance risk from an AI workflow.
Actions, not data access, for execution control
Execution control keeps actions within what was approved and never repeats the same effect; which data reaches a model is handled by AI Data Masking.
Not functional safety
In robotics, execution control works at the level of discrete tasks and does not replace functional safety or interrupt motion in progress. Bypass protection requires effect-producing credentials to sit behind the controlled path.
Test one masked AI call in your environment.
We will work with your team to define the data boundary, configure the rules and review the resulting evidence.
Please do not send production data, credentials or sensitive samples by email.