Enterprise-grade security for your code and data.

Zero Data Retention means your prompts, code context, and model completions are processed in memory and discarded after the response is returned — nothing is written to disk, nothing is retained by Blackbox. ZDR is enabled by default on Pro and above. The Enterprise ZDR tier additionally disables abuse monitoring, adds contractual training-opt-out commitments with upstream providers, and enforces ZDR end-to-end across the API, IDE, CLI, Cloud agent, VS Code extension, and mobile app.

No. Training opt-out is the default on every plan — your code is never used to train Blackbox models. Enterprise contracts include contractual training-opt-out commitments with every upstream model provider we route to, wherever the provider's API supports it.

Yes. On the Enterprise ZDR tier, abuse monitoring and human review are disabled. For regulated customers who cannot tolerate any side-channel prompt inspection, this is committed contractually and enforced technically at the infrastructure layer.

All data at rest uses AES-256 encryption with keys managed in AWS KMS. All data in transit uses TLS 1.3 with modern cipher suites and certificate pinning on mobile clients. Enterprise plans support customer-managed keys (BYOK/CMK), end-to-end chat encryption, and zero-knowledge architecture so even Blackbox infrastructure cannot read your content.

Enterprise customers can deploy Blackbox in a dedicated VPC within our infrastructure, on-premise inside their own data center, or in a fully air-gapped environment with no outbound internet. Regional data residency is available in US and EU, and self-hosted Git integrations (GitHub Enterprise Server, GitLab self-managed, Bitbucket Data Center) are fully supported.

Yes. Enterprise plans include SAML 2.0 SSO with Okta, Azure AD, Google Workspace, OneLogin, and any other SAML-compliant provider. SCIM 2.0 automates user and group provisioning, and fine-grained RBAC lets admins control access to repositories, models, and agent capabilities per team or individual. Microsoft-first organizations can also see our dedicated Microsoft Partner page for Azure AD / Entra ID deployment details.

Blackbox's SOC 2 Type II and ISO 27001 audits are currently in progress with an annual third-party audit cadence. We are GDPR and CCPA compliant, and HIPAA BAAs are available for healthcare customers. Interim audit letters, current scope, and a full list of subprocessors are available under NDA — contact enterprise@blackbox.ai to request access.

Yes. Tamper-evident audit logs capture every authentication event, agent execution, repository access, model invocation, and configuration change. Logs can be streamed in real time to your SIEM (Splunk, Datadog, Sumo Logic, Elastic) via webhook or exported to S3. Retention is configurable from 30 days to 7 years.