Security & operations

Designed for enterprise change-management.

SovereignEG is engineered to support enterprise governance from day one and is on a path toward formal compliance attestations. Below is exactly which controls ship in product today and which are explicit design goals — nothing more, nothing less.

TLS in transit

on every public endpoint

Request logs

per project, last 30 days

Roles + per-project keys

enforced server-side

Designed for PDPL

Egypt-hosted sovereign tier

Controls

What ships today — and what is on the active roadmap.

We mark items with a check when they are in product right now, and with a circle when they are explicit design goals — not yet formal certifications.

Ships today

In product, right now

Live in production and reachable through the public API and dashboard.

Encryption everywhere
TLS in transit on every public endpoint; encrypted-at-rest Postgres + Redis on managed infrastructure.
Request log
Inference requests are logged with request ID, model, status, latency and cost, and your team can review them per project on the dashboard Logs page.
Roles + per-project keys and limits
Org roles (Owner, Member, Viewer) and project roles (Owner, Member) are enforced server-side. Each API key belongs to one project and carries that project's model allow-list and spend cap.
Per-key and per-project spend caps
Monthly EGP caps per API key and per project, checked before each request (a request already running can finish past the cap), optional key expiry, one-shot reveal, and instant revoke.

Design goals

On the active roadmap

Explicit commitments tied to the sovereign tier and the formal security review.

Egypt PDPL alignment
Designed to support the Egypt Personal Data Protection Law and sector-specific residency rules on the sovereign tier.
SOC 2 / ISO-style controls
On the roadmap for the Egypt-hosted sovereign deployment as the platform matures and customer-driven audits begin.

Operations

Operated in the open.

We publish what is live, what is upstream-routed, and what requires a sovereign hosting agreement. Formal SLA and status-history pages follow once we have enough operating history to publish honestly.

Status

Beta

Open self-serve signup

Anyone can sign up; API keys unlock once the email address is verified. New organizations start on the default rate tier and pay from a prepaid EGP balance.

Routing

Transparent

Standard routing today

Public model cards disclose live status, provider, context window, and EGP pricing.

Support

Human

Direct engineering support

Our team can trace request IDs, audit events, and routing during the beta phase.

Provider transparency

Standard inference requests may be routed to vetted upstream model providers. Dedicated Egypt-hosted deployments are available on request for regulated workloads. The full disclosure is published in the legal pack.

Read the disclosure

Security researchers

Report a vulnerability

If you believe you have found a security issue, email support@sovereigneg.com with steps to reproduce, impact, and your contact details. We acknowledge reports within five business days and will not take legal action against good-faith research that follows this policy.

Reference