Defense AI: Security Controls

Last updated: November 11, 2026

This article lists the security controls built into Defense AI, for IT admins and anyone completing a security review. It also lists what Defense AI doesn't do, so you can plan other controls around it.

Where data goes

  • US regions only. Models and gateways are deployed only in US regions of Azure Government, Azure Commercial or Google Cloud.

  • US-only model deployments on Azure. Only Standard and Data Zone Standard (US) deployments are allowed. Global deployments, which can process requests outside the US, are refused.

  • Claude traffic crosses clouds. If you use the Claude add-on, Claude requests leave your Azure environment and go over an encrypted connection to Google's US Vertex AI endpoint, using Workload Identity Federation instead of stored keys.

  • FedRAMP boundary checks. Azure deployments use FedRAMP High-authorized clouds. Google Cloud setup checks that your project is in an Assured Workloads folder with US locations and an active FedRAMP regime.

Data handling

  • No prompt or response storage. The gateway logs errors only and doesn't write prompt or response content to its database.

  • Response caching off by default. If an admin turns it on, cached responses live only in the gateway's memory for a short time and are never written to disk.

  • Usage totals only. The admin portal stores daily request counts, token counts and estimated cost.

Keys and credentials

  • HTTPS endpoint with personal keys. Your gateway is reached over HTTPS at a public endpoint in your Azure subscription. Every request needs a personal gateway key.

  • Personal keys. Each person signs in with their Microsoft work account and gets their own gateway key. Keys are masked on screen, and the portal asks for confirmation before replacing one.

  • Encrypted secrets. Gateway admin keys and short-lived setup sign-ins are encrypted at rest with AES-256 and can't be read from the browser.

  • Short-lived setup access. Azure setup sign-ins expire within 10 minutes and Google Cloud setup sign-ins within 60 minutes. Both are deleted when setup finishes.

  • No static Google keys. Your gateway reaches Google Cloud through Workload Identity Federation, using your gateway's Azure managed identity.

Admin access

  • Server-side permission checks. Every admin change is checked on the server against the person's role, not just hidden in the interface.

  • Audit log. Every admin change is recorded in an audit log.

  • Tenant isolation. Each company's data in the portal is separated by database row-level security, so one company can't see another's settings or usage.

The gateway software

  • Pinned versions. Each gateway runs a container image pinned to an exact digest from an Atomus-managed container registry in your company's cloud (Azure Government for GCC High, Azure Commercial for GCC). Updates are staged and rolled out deliberately.

  • Upstream advisories. Atomus checks advisories for the open-source gateway software before updates.

  • Verified models. Admins can deploy only models and versions on Defense AI's approved list.

  • Smoke test. Setup runs a test request through the gateway to confirm each model responds.

What Defense AI doesn't do

Plan for these separately:

  • No data loss prevention (DLP). Defense AI doesn't scan or block what people paste, upload or send.

  • No record of prompts. Because prompts aren't stored, there's no after-the-fact log of what someone sent. You can see usage totals, not content.

  • No content rules. There's no setting to block particular kinds of content before it reaches the model.

  • No device control. Defense AI doesn't manage the computers your tools run on. Endpoint management, disk encryption and access control on those devices are up to your company.

If you need these capabilities, talk to your Atomus contact about the tools in your wider environment that can provide them.

What you control

  • Budgets and rate limits for the company, teams or individuals

  • Which models are deployed

  • Which connectors are allowed, and whether Microsoft 365 is read-only or read and edit

  • Who can sign in, through your Microsoft work accounts

Related articles: Defense AI: Data Retention, Who Sees Our Data, Is it Used for Training · Defense AI: Where Your Data Is Processed (US Data Centers and FedRAMP) · Defense AI: What Setup Creates and What Permissions It Asks For · Defense AI: Using AI Coding Agents: Files, Secrets and Repository Content