Data privacy

SUPERWISE® Sentinel is built around a strict privacy boundary between your environment and the SUPERWISE cloud. Your raw prompts and responses are never sent to SUPERWISE; only the operational metadata listed below is. Sensitive content your guardrails catch (secrets, PII, toxic text) is replaced with placeholders, or the request is blocked, before it leaves the machine or network where the gateway runs. The redacted request then goes on to the LLM provider you chose, as it would without Sentinel.

The diagram shows three paths from the Sentinel gateway:

1. Your apps to the gateway: the full prompt, inside your machine or network.
2. The gateway to the upstream LLM (OpenAI, Anthropic, or Gemini): the redacted prompt.
3. The gateway to the SUPERWISE cloud (the control plane): operational metadata only, and the gateway pulls its guardrail configuration back over the same outbound connection.

For the general question, beyond Sentinel, see Where does your data go when people use AI? on superwise.ai.

How does a gateway sync with SUPERWISE?

Each Sentinel gateway opens a secure outbound connection to the control plane; the control plane never connects in to the gateway. On every heartbeat (every 60 seconds) it reports basic operational metadata and pulls down the latest guardrail configuration to enforce locally. For how heartbeats drive gateway lifecycle and states, see Deploy a gateway.

What telemetry reaches SUPERWISE?

The metadata is tied to your tenant and to the Sentinel that sent it.

For each interaction, a gateway reports operational metadata only: timing, routing, model, outcome and policy breakdown, latency, token counts, and token-optimization savings. Live activity is the source of truth for the full field list, and it's the same data the Operational dashboard and FinOps dashboard show.

For each gateway, on registration and on every heartbeat: the Sentinel's ID, name, and location, its version, its status, the time of its last heartbeat, and the gateway URL it reports, either SENTINEL_EXTERNAL_HOST or its auto-detected local IPv4 address. See Gateway reference.

None of these fields carries prompt text, response text, system instructions, or the values a guardrail replaced.

How long is the metadata kept?

One year while your account is active. Each record identifies the Sentinel that sent it, not the person using the computer. Export to a SIEM is on the roadmap.

Does SUPERWISE ever see my prompts?

Your prompts, model responses, and system instructions are never transmitted to the SUPERWISE cloud, and no transaction content is stored there. Requests are forwarded to your chosen upstream LLM provider, with sensitive content redacted at the edge first, while SUPERWISE receives only the operational metadata described above.

See also

• Architecture: the control plane and the gateways.
• Live activity: the metadata each interaction produces.
• What is Sentinel?: what Sentinel does and the tools it covers.