AI Security

Glyph is local-first. Models can run entirely on the device, and the built-in baseline policy continues to work offline. When a user chooses a cloud model, the request is sent to that provider under the customer's agreement with the provider; Fortaify does not proxy prompts through its control plane in the documented architecture.

Platform credentials (billing, email, identity, model-catalog tokens) are stored server-side as environment secrets, never in the client bundle. Provider secrets entered for optional cloud destinations are handled by the client and are not transmitted to Fortaify. Detection of secrets and sensitive data in the Glyph Trust pipeline is designed to reduce risk; no detector is perfect, and it is a control, not a guarantee. No customer content is used to train models.