Settings — Security
API keys, blockchain wallet, encryption, and the Neural Governance Engine.
Navigate to Settings → Security. This page is for platform admins; other roles see a read-only view.
API keys
Project API key
Generated when the project is created. Format: pv_live_.... Every project key is a live key — there is no separate test or sandbox key.
To rotate: click Rotate key, confirm, copy the new value. The old key is invalidated immediately.
After rotation, every integration needs the new key. Stage rotation: rotate in a test project first, deploy your client update, then rotate in production.
Browser Guard
The Browser Guard extension authenticates with the project API key (pv_live_...) — there is no separate extension key type. Rotating the project key therefore also re-keys every deployed Guard instance.
Agent keys
Issued automatically when an agent is registered (format: ag_...) and stored hashed at rest only — neither the registration response nor the dashboard ever reveals the plaintext. The key is not yet accepted for API authentication (reserved for future agent-scoped auth) and is invalidated when the agent is revoked or rejected.
Neural Governance Engine (NGE)
NGE runs local ONNX models inside the gateway for sub-50 ms PII, injection, and intent detection. Configure under Settings → Security → Neural Governance Engine.
Engine mode
Pick the engine that powers verify decisions:
| Mode | Behavior | Cost / latency |
|---|---|---|
| Disabled | Pure regex + LLM-assist (pre-Sprint-54 behavior) | Highest LLM cost, ~300-800 ms latency |
| NGE Local | Local inference only; never escalates to LLM | Zero LLM cost, ~30-50 ms |
| NGE Fallback (default) | Local-first; borderline cases escalate | 85-95% LLM cost reduction, ~30-50 ms typical |
| LLM Only | Skip local inference, always call cloud LLM | Most expensive; useful only for benchmarking |
Most customers run NGE Fallback. Switch to NGE Local for strict data-residency requirements; full air-gapped deployment is on the roadmap (see On-premise & air-gapped).
Sensitivity preset
A single slider that maps to internal thresholds across all five NGE stages:
| Preset | Behavior | When to use |
|---|---|---|
| Strict | Lower thresholds, more BLOCK / MODIFY decisions | Healthcare, finance, government |
| Balanced (default) | Vendor-tuned thresholds | General enterprise use |
| Tolerant | Higher thresholds, fewer interventions | Internal R&D, developer tooling |
The preset adjusts NGE confidence cutoffs across all stages — Regex, Aho-Corasick, ONNX NER, NLI Contextual, and LLM-Assist.
Shadow mode
Toggle Shadow mode to run the engine for evaluation without enforcing decisions. Traces show what would have happened (BLOCKED, MODIFIED) but the request always passes through. Use Shadow mode for:
- A/B testing a stricter sensitivity preset before rolling it out
- Validating NGE accuracy against a known-good corpus
- Onboarding new agent types without false-positive blocks
Language coverage
Detection coverage by language is measured and documented in Detection Coverage — it is a product capability, not a setting.
Entity redaction
Always on, and not switchable. Detected entities are redacted in the output returned by /verify and stored redacted in traces. The trace keeps category, position and confidence — it never keeps the original value.
Until August 2026 redaction could be disabled. That path was removed: trace metadata is not field-encrypted and traces are append-only, so an original value written once could neither be protected afterwards nor deleted.
Insight into recognised personal data
Controls who may retrieve original values in the Trace Explorer — not what is stored. What is stored is the same either way.
| Option | Effect |
|---|---|
| Insight for authorised users | Users with reveal permission can retrieve recognised personal data in the original. Every retrieval is logged. |
| No insight | Original values are retrievable by no one, not even administrators. |
This setting applies retroactively to all traces already recorded, not only to those recorded after the change. Switching from "Insight for authorised users" to "No insight" also locks access to the entire existing corpus — and switching back opens it again.
This setting does not govern what the model gets to see. That is the job of the respective agent's privacy profile.
Blockchain configuration
Wallet mode (Platform-managed or BYOW — Bring Your Own Wallet), attestation level (MANDATORY_ONLY, BROAD, EXHAUSTIVE), smart contract address, and verification link. See Configure Wallet for the full setup.
Encryption
| Option | Available from | Description |
|---|---|---|
| Standard | Community | AES-256-GCM with a Palveron-managed key |
| BYOK (planned) | Enterprise (roadmap) | Bring Your Own Key — KMS-backed (AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault). Architecture is in place; rollout follows the launch milestone. |
BYOK encryption is on the post-launch roadmap and not yet generally available. The behaviour described here is the planned design. Contact sales if you need BYOK as part of an enterprise contract — early-access slots are limited.
The planned design: BYOK projects will be able to revoke encryption keys to render historical data unreadable — useful for legal-hold release or right-to-be-forgotten flows.
Palveron Discover (Business / Enterprise)
Per-project toggle for behavioral AI discovery (SSE fingerprinting + extension inventory). See Shadow AI Dashboard for what it surfaces.