Arkheia · Enterprise Proxy
Detection for
every AI call
A self-hosted HTTP proxy that sits in front of all your AI API traffic — cloud providers and internal models alike. Detection stays inside your boundary. Nothing leaves.
§ 01 · What It Is
A transparent proxy inside your infrastructure
The Arkheia Enterprise Proxy runs as a FastAPI server inside your deployment boundary. Route all outbound AI API calls through it — or call the standalone detection endpoint directly from your application layer. Either way, signals are extracted, scored, and logged without leaving your environment.
Forward Proxy Mode
Point your AI API calls at the Enterprise Proxy instead of calling providers directly. Requests are forwarded, signals extracted in transit, and enriched responses returned — all inside your boundary.
# One env var change per provider OPENAI_BASE_URL=https://ai-proxy.internal/v1 ANTHROPIC_BASE_URL=https://ai-proxy.internal
Standalone Detection Mode
Already have a routing layer? Call the detection endpoint directly after receiving any AI response. Always returns HTTP 200 — never blocks your pipeline.
POST https://ai-proxy.internal/detect/verify
{
"prompt": "...",
"response": "...",
"model_id": "gpt-4o"
}§ 02 · Detection API
One endpoint. Always safe to call.
The detection endpoint is designed as a pipeline primitive — it never throws, never blocks, and never returns 4xx or 5xx. Your application logic decides what to do with the result.
Request
POST /detect/verify
Content-Type: application/json
{
"prompt": "Explain RFC 7230",
"response": "RFC 7230 defines...",
"model_id": "claude-opus-4-6",
"session_id": "sess_abc123" // optional
}Response — always HTTP 200
// Normal detection:
{
"risk_level": "LOW",
"confidence": 0.12,
"detection_id": "det_abc123"
}
// On detection failure (fail-open):
{
"risk_level": "UNKNOWN",
"confidence": 0.0,
"detection_id": null
}Design contract
- Always HTTP 200 — detection failures return risk_level: UNKNOWN, never 4xx/5xx
- Fail-open — a detection error is never a pipeline error
- Audit trail — every detection_id is logged inside your boundary
- Pull-only — the proxy never initiates outbound connections to Arkheia infrastructure
§ 03 · Who It's For
Enterprise teams with strict data perimeter requirements
Mixed AI environments
You call both cloud providers (OpenAI, Anthropic) and internal self-hosted models. The Enterprise Proxy handles both in a single detection layer — no separate tooling for each.
Data sovereignty
Strict requirements around where AI traffic and telemetry can travel. The Enterprise Proxy runs entirely inside your deployment boundary — detection signals and audit logs never leave.
Existing API routing layers
You already route AI calls through an API gateway or service mesh. The Enterprise Proxy integrates as a sidecar or standalone detection layer — no rearchitecting required.
Regulated industries
Finance, healthcare, legal, government — anywhere the audit trail must remain on-prem and detection telemetry cannot traverse a public network.
§ 04 · Deployment
Runs wherever your infrastructure runs
01
Docker
Single container. Configurable via environment variables. Detection profiles mounted from a volume.
02
Kubernetes
Deploy as a sidecar or standalone service. Works with your existing ingress and service mesh.
03
Bare metal / VM
Runs as a standard Python process. No GPU required — detection is CPU-only.
§ Get Access
Request a deployment briefing
Enterprise Proxy is available to pilot partners. Contact us to discuss your infrastructure requirements and deployment timeline.