Custom work & consulting
Your LLM feature has to pass the AI Act. We help you build it so it does.
SafeLLM's product is a gateway for Apache APISIX. If you are on another stack, or your case is more than a plugin can cover, the same team builds the controls with you: personal data that never reaches the model, confidential text that stays in-house, logs an auditor can read, and numbers measured on your own data.
Who it's for
This is for you if
You are not on APISIX
Kong, Envoy, NGINX, LiteLLM, an OpenAI-compatible proxy, or calls straight from your app. We put the same layers (PII masking, prompt-injection checks, output DLP, audit logs) where your traffic actually flows.
Compliance asked "what goes to the model?"
Your team ships a chatbot, copilot or agent, and legal or the DPO needs an answer: which data leaves the company, who decided, where is it logged. We turn that question into controls and evidence.
Confidential text, not just personal data
Contracts, board notes, pricing, unreleased results. PII filters miss them (in our benchmark on real company mail, PII detectors let 60–82% of confidential mail through). We add a decision step that reads context and can run fully on your machines.
Agents that act on their own
Coding agents and tool-using assistants send requests you never see. We measure what leaves (server-side, on your setup) and add guards such as identity-aware hooks and egress policies.
Services
What we do
AI Act & GDPR readiness for LLM features
Map your AI use cases, data flows and risk level; design the technical controls: record-keeping and logging, human oversight, transparency, data minimisation. We work alongside your legal counsel; we are engineers, not a law firm.
Custom guardrails on your stack
PII detection and masking (including Polish and other EU identifiers), prompt-injection defence, output DLP and audit logs, built into the gateway, proxy or SDK you already use. Open-source core where possible, no lock-in.
Keep confidential data in-house
Local decision models (for example basal, a small open model from Poland) that decide per request whether text may go to a cloud LLM, plus routing to a local model when it may not. CPU-friendly and air-gap capable.
Evaluation on your own data
Before you trust a filter, measure it. We build a small labelled set from your traffic and report leak rates with confidence intervals, the same method as our public benchmarks, so the numbers hold up in front of an auditor.
Process
How we work
1. Free 30-minute call
You describe the feature, the stack and what compliance is asking. We tell you honestly whether we can help.
2. AI risk snapshot
A short written review: where data leaves, the main gaps, quick wins and priorities for the first 30 days. Free.
3. Fixed-scope project
An assessment, a build or both, with a clear deliverable and price agreed up front.
4. Handover
Code in your repository, documentation your auditor can read, and a session with your team. Optional support afterwards.
FAQ
Do we need to run APISIX?
No. The SafeLLM product targets APISIX; consulting and custom builds work on whatever stack you have.
Is this legal advice?
No. We design and build the technical side (controls, logs, evaluations, documentation of how the system works) and work with your lawyer or DPO, who makes the legal calls.
Does our data leave our infrastructure?
It does not have to. We can work on-site or in your environment, and the controls we build can run fully locally, including air-gapped.
Who will we work with?
The engineers who build SafeLLM and run its public benchmarks. EU-based, small team, direct contact.
Tell us what compliance is asking.
We will tell you what to build, and whether you need us for it.