Skip to content
LokiAI logomark

Security

Controls that are enforced in the product

This page is maintained by THE SHRIKS to answer common security questions about LokiAI. It describes controls that are implemented today, not certifications.

  • Local inference
  • Device-scoped credentials
  • Verified artifacts

01Access and identity

Strict Security Boundaries

Control Plane

  • [Encrypted Provider Keys]
  • [Tenant Isolation]
  • [Rate Limits]
← HTTPS / WSS →STRICT CORS

Edge Device

  • [Device-Scoped Creds]
  • [Local Execution]
  • [Offline Inference]

02Data handling

Where data goes

  • Inference inputs — prompts, frames and audio — are processed on the device and are not routed through LokiAI infrastructure.
  • Model weights are downloaded by the device directly from the source CDN; the control plane does not proxy them.
  • Provider keys are stored encrypted at rest and are never returned to the browser in raw form.
  • Deployment records store artifact metadata and state transitions, not payload content.

03Shared responsibility

Where our boundary ends

LokiAI provides

Isolation between accounts, credential issue and revocation, artifact verification and transport security.

You are responsible for

Physical control of paired devices, who you grant account access to, and the models you choose to deploy.

Reporting

If you believe you have found a vulnerability, contact us before disclosing it publicly.

Security questions before a deployment?

Ask us directly — we would rather answer specifics than publish absolutes.

Contact usPlatform overviewContact us