Safety & Security
Security standards on Larkup
Larkup is built around providing secure AI infrastructure for developers and enterprises. When connecting proprietary data sources to LLMs, security cannot be an afterthought.
Our platform architecture is designed with a "private by design" philosophy. Every component of our RAG pipeline, from data ingestion to vector storage and retrieval, is built to protect your data and enforce strict access controls.
While we provide the infrastructure, secure AI deployment is a shared responsibility. We give you the tools to filter, evaluate, and restrict model outputs, but developers must remain vigilant in monitoring system boundaries and configuring appropriate role-based access.
Data Privacy & Isolation
Your data remains yours. We never use your indexed documents, user queries, or chat history to train our underlying models.
For enterprise deployments, Larkup supports strict tenant isolation. Vector indices are logically separated, and we offer single-tenant clusters or VPC peering for organizations requiring dedicated hardware and complete network isolation.
All data is encrypted in transit using TLS 1.3 and at rest using AES-256. API keys are hashed and salted, and temporary access tokens are scoped tightly to specific resources and time windows.
Access Control & Document Permissions
A reliable RAG system must respect document-level permissions. If a user cannot access a file in your internal systems, the AI should not use that file's content to answer their questions.
Larkup syncs access control lists (ACLs) directly from your data sources (like Google Drive, Notion, or internal databases). When executing a retrieval query, the vector search is automatically filtered based on the end-user's identity, ensuring no unauthorized data leakage occurs during generation.
Prompt Injection & Output Filtering
Exposing LLMs to public users carries inherent risks, including prompt injection, jailbreaking, and the generation of harmful content.
Larkup provides built-in safeguards. Our API endpoints support configurable input sanitization and adversarial intent detection before the query reaches the embedding model or the LLM.
For the generation phase, you can enforce strict grounding. If the retrieved context does not contain the answer, the system can be configured to decline the prompt rather than hallucinating, mitigating the risk of providing incorrect or harmful advice.
Reporting Vulnerabilities
We take security reports seriously. If you believe you have found a security vulnerability in the Larkup platform, API, or SDKs, please report it immediately.
Please send reports to:
Please include detailed steps to reproduce the issue, the affected endpoints, and any relevant logs. We ask that you do not publicly disclose the vulnerability until we have had an opportunity to address it and deploy a patch.