Detect and Redact PII
- Redact emails, SSNs, financial, and medical data before they leave your gateway
- Run PII detection through AWS Bedrock, Google Model Armor, or Patronus AI
- Use the built-in PII template or define your own regex patterns
[ OVER 1,000+ TEAMS USE BIFROST ]
[ INTEGRATIONS ]
Bring your own guardrail providers, or use ours
Chain any combination of external providers in a single rule, or run Bifrost-native checks entirely inside your own environment.
AWS Bedrock
Azure Content Safety
Google Model Armor
CrowdStrike AIDR
GraySwan Cygnal
Patronus AIAWS BedrockAzure Content SafetyGoogle Model ArmorCrowdStrike AIDRGraySwan CygnalPatronus AIAWS BedrockAzure Content SafetyGoogle Model ArmorCrowdStrike AIDRGraySwan CygnalPatronus AIAWS BedrockAzure Content SafetyGoogle Model ArmorCrowdStrike AIDRGraySwan CygnalPatronus AIBifrost-native checks
Gitleaks secrets detectionBuilt-in PII templateCustom regex patterns
[ AI GUARDRAILS CAPABILITIES ]
Real-time AI guardrails on every request
Detect PII, prompt injections, secrets, unsafe content, and unsupported claims in real-time - before requests reach a model or a model response reaches your users
Block Prompt Injections
- Stop injection and jailbreak attempts before they reach your model
- Catch indirect attacks hidden inside tool results or retrieved content
- Block by confidence and severity through Azure, Google Model Armor, or GraySwan
Filter Unsafe Content
- Block toxic, unsafe, or off-policy content across text and images
- Flag hallucinated or unsupported claims before they reach users
- Tune severity thresholds and choose to block, redact, or modify
CONTENT SAFETY
SCORING
BLOCKED
THRESHOLD
hate
violence
self-harm
sexual
[ SEVERITY THRESHOLD: MEDIUM ]
Define Custom Policies with CEL
- Write custom validation logic with Common Expression Language
- Target rules by model, message role, content length, or keywords
- Chain multiple guardrail providers in one rule for layered enforcement
Audit Every Guardrail Decision
- Capture rule, provider, violation type, severity, and action on every decision
- Keep immutable, timestamped records for SOC 2 Type II, HIPAA, and GDPR
- Export logs to S3, GCS, or BigQuery
Run Native Guardrails With No Added Latency
- Block leaked API keys, tokens, and credentials with Gitleaks-backed secrets detection
- Define custom regex patterns or use the built-in PII detection template
- Keep all validation inside your environment with no data sent to third parties
[ HOW IT WORKS ]
Validating Inputs and Outputs in Real-Time
Configure providers once, write rules for when to validate, and enforce policies on inputs, outputs, or both.
Two-Tier Architecture: Rules + Profiles
Profiles
- Configure each guardrail provider once, native or external
- Set credentials, endpoints, and detection thresholds in one place
- Reuse the same profile across any number of rules
Rules
- Write CEL logic to target specific requests
- Apply each rule to input, output, or both
- Link one or more profiles for layered validation
Request validation flow
Validation outcomes
Pass
HTTP 200
Validation succeeded. Request processed normally with detailed guardrail metadata including processing times and rule results.
Block
HTTP 446
Violations detected and request blocked. Response includes violation details, severity levels, and affected content excerpts for audit trails.
Warning
HTTP 246
Violations detected but content modified (PII redacted) rather than blocked. Includes redaction counts and modification details.
[ DEPLOY ANYWHERE ]
Enforce organization policy with native or third-party guardrails on infrastructure you own
Guardrails sit alongside virtual keys, budgets, and audit logs in one deployment.
One policy layer
Guardrails, governance, and observability in a single gateway — one deployment for models and tools.
Single deploymentRules + Profiles
Rules decide what to check and when. Profiles decide how and which provider runs the check.
CEL · Multi-providerBlock, redact, or warn
Pass, block, or modify content with distinct HTTP status codes and full violation metadata.
200 · 446 · 246[ COMPLIANCE FRAMEWORKS ]
Built for Regulatory Compliance And Enterprise Scale
Bifrost Guardrails help organizations meet regulatory requirements with automated detection, redaction, and comprehensive audit trails.
[ ON YOUR INFRASTRUCTURE ]
Validation that never leaves your perimeter
Bifrost is self-hosted. Guardrails execute in the same process that serves your traffic, so sensitive content is inspected without being shipped anywhere you did not choose.
Keep keys and data in your environment
- Store every provider credential inside the gateway, never in client code
- Keep all request data within your own infrastructure
- Rotate provider keys without touching a single application
Deploy anywhere, including air-gapped
- Run fully in your VPC or air-gapped private network
- Deploy with no external dependencies or outbound calls
- Self-host under Apache 2.0, or run fully managed
Meet enterprise compliance standards
- Comply with SOC 2 Type II, HIPAA, GDPR, and ISO 27001
- Maintain audit-ready records across every request
- Enforce one consistent policy across teams and providers
[ FAQ ]
Frequently Asked Questions
AI guardrails are policy checks that run on model inputs and outputs. Each prompt is inspected before it reaches a model, and each response before it reaches a user. Checks cover sensitive data, injection attempts, secrets, and unsafe content, with three outcomes: pass, block, or redact.
Models follow instructions in their input, including instructions an attacker planted there. They also repeat whatever is in their context, including data that should not leave your systems. Guardrails apply the checks the model itself cannot: what may go in, what may come out.
Common examples: PII detection and redaction, prompt injection and jailbreak blocking, secrets scanning, toxicity and content filtering, and hallucination or unsupported-claim flagging. In Bifrost each runs as a rule you attach to a profile, applied to inputs, outputs, or both.
Detection runs on the input before it reaches the model, scoring the prompt for injection patterns and checking content retrieved from tools or documents, the indirect path attackers use. Bifrost routes this through Azure, Google Model Armor, or GraySwan, and blocks by confidence and severity threshold.
AWS Bedrock Guardrails, Azure Content Safety, Google Model Armor, CrowdStrike AIDR, GraySwan Cygnal, and Patronus AI, plus native checks: Gitleaks secrets detection, a built-in PII template, and custom regex.
Yes. External guardrail providers add about 50-500ms per validation in practice, depending on the provider and how complex the check is. Bifrost offers sampling (validate a percentage of requests), async processing (validate in the background), and timeout controls to balance security and performance. Bifrost-native checks such as secrets detection and regex-based PII run in-process and add no external round trip.
Yes. Bifrost supports defense-in-depth by linking multiple provider profiles to a single rule. For example, use AWS Bedrock for PII detection + Azure for content moderation + Patronus for hallucination detection on the same request.
Guardrails are optional and selective. Use CEL expressions to apply rules based on request path, model, virtual key, user attributes, or content. For example, only validate customer-facing endpoints while skipping internal testing traffic.
Protect every prompt and response
Put guardrails in front of every model your organization uses, and govern who can call them from the same gateway.
[ BIFROST FEATURES ]
Open Source & Enterprise
Everything you need to run AI in production, from free open source to enterprise-grade features.
01 Governance
SAML support for SSO and Role-based access control and policy enforcement for team collaboration.
02 Adaptive Load Balancing
Automatically optimizes traffic distribution across provider keys and models based on real-time performance metrics.
03 Cluster Mode
High availability deployment with automatic failover and load balancing. Peer-to-peer clustering where every instance is equal.
04 Alerts
Real-time notifications for budget limits, failures, and performance issues on Email, Slack, PagerDuty, Teams, Webhook and more.
05 Log Exports
Export and analyze request logs, traces, and telemetry data from Bifrost with enterprise-grade data export capabilities for compliance, monitoring, and analytics.
06 Audit Logs
Comprehensive logging and audit trails for compliance and debugging.
07 Vault Support
Secure API key management with HashiCorp Vault, AWS Secrets Manager, Google Secret Manager, and Azure Key Vault integration.
08 VPC Deployment
Deploy Bifrost within your private cloud infrastructure with VPC isolation, custom networking, and enhanced security controls.
09 Guardrails
Automatically detect and block unsafe model outputs with real-time policy enforcement and content moderation across all agents.
[ SHIP RELIABLE AI ]
Try Bifrost Enterprise with a 14-day Free Trial
[quick setup]
Drop-in replacement for any AI SDK
Change just one line of code. Works with OpenAI, Anthropic, Vercel AI SDK, LangChain, and more.
1import os
2from anthropic import Anthropic
3
4anthropic = Anthropic(
5 api_key=os.environ.get("ANTHROPIC_API_KEY"),
6 base_url="https://<bifrost_url>/anthropic",
7)
8
9message = anthropic.messages.create(
10 model="claude-3-5-sonnet-20241022",
11 max_tokens=1024,
12 messages=[
13 {"role": "user", "content": "Hello, Claude"}
14 ]
15)
Drop in once, run everywhere.