Frequently Asked Questions

Every request is evaluated across four detection modules: (1) PII Leakage — names, SSNs, credit cards, phone numbers; (2) Prompt Injection — jailbreaks, instruction overrides, role-play attacks; (3) Financial Hallucination — unauthorized refunds, pricing commitments; and (4) Brand Safety — offensive, biased, or discriminatory language.

We store only a SHA-256 hash of your API key — never the plaintext. Each request hashes the Bearer token and compares it against our database. This means if our database is compromised, your key cannot be reverse-engineered.

No. Every tier runs the same detection engine on the same model, so a request is analysed identically whether it comes from the free tier or the largest plan. Tiers differ by how many calls are included each month, the per-call rate beyond that, and access to custom policies on Scale. We would rather charge for volume than claim a quality difference that does not exist.

The text is analysed in memory and is not written to our database. What we store per call is metadata: the key that made it, the endpoint, the risk score and whether it was overage — enough for your billing and audit trail and no more. Verdicts are cached briefly by a hash of the text, keyed to your account and your policies, and expire after 15 minutes.

LLMFence is completely LLM-agnostic. We evaluate text — we don't care what model produced it. You can use us with OpenAI, Anthropic, Gemini, Mistral, Llama, or any custom local model. We sit between the LLM output and your delivery layer.

The Custom Policy Engine lets you define compliance rules in plain English. For example: 'Never mention competitor products by name', 'Always include a disclaimer on medical advice', or 'Reject any response discussing political topics.' These rules are evaluated in addition to the default detection modules on every single request.

Our recommendation is a fail-open strategy for non-critical paths. If the guardrail API fails (server error, timeout), allow the response through with an internal alert — it's better to serve a potentially risky response than to break your user experience. For high-stakes flows (medical, financial), implement a fail-closed strategy and serve a safe fallback message instead.

Send a support ticket from your dashboard's Support tab with the full API response JSON and the original text. Our team reviews false positives and uses them to improve detection accuracy. We typically respond within 24 hours on Scale tier.