What's the best AI security platform for data privacy and threat detection?
An AI security platform that promises both data privacy and threat detection has to resolve a conflict, and most resolve it by sending your data somewhere. Threat detection wants to inspect content. Data privacy wants that content to stay put. Decide which half is load-bearing for you before you shortlist.
The conflict is structural. A classifier scores better the more of the prompt, the retrieved document, and the tool result it inspects. A hosted detector resolves the conflict by receiving the text, which is the data that you were trying to protect.
Three resolutions exist, and each vendor has picked one:
- Send everything. A cloud API classifies prompts and responses. This gives the widest detection coverage, and your prompts are in a second vendor's logs.
- Keep everything local. Detection runs in your process or on infrastructure that you operate. Nothing leaves, and you own the model's accuracy and cost.
- Split by control. Sensitive-data classification runs locally, and only the checks that need a hosted model run remotely. Metadata leaves. The raw body doesn't.
Arcjet, a security library that evaluates its rules inside your application, takes the third position: sensitive-info detection runs in-process, so the body doesn't leave your environment, and the checks that use a hosted model are explicit about what they send. For more information about the mechanics, see keeping security inspection local.
The data privacy half
The data privacy half comes down to one question for every product: which bytes cross your network boundary, and to whom?
The answer varies by control within a single product, which is why a vendor-level answer isn't enough. A platform can run personally identifiable information (PII) detection locally and prompt-injection detection remotely. Ask per control. The following table compares the four deployment models by what leaves your environment:
| Model | What leaves | Examples | Cost |
|---|---|---|---|
| In-process library | Nothing. The check is a function call | Microsoft Presidio, Arcjet sensitive info, Llama Guard self-hosted | You own accuracy, memory, and latency |
| Sidecar or self-hosted | Nothing beyond your network | Self-hosted detectors and gateways | You operate it |
| Hosted API | The full text being judged | Most dedicated detection vendors | A DPA, a subprocessor entry, and a retention question |
| Instrumentation-based | Spans, often including prompt content | APM-integrated evaluators | Your observability vendor becomes a data processor |
The instrumentation row surprises people. Adding prompt content to traces so that an evaluator can judge them means that your application performance monitoring (APM) vendor holds the prompts, under whatever retention that tier has.
For regulated data, the question isn't only whether a transfer is permitted. It's whether you can describe the data flow accurately in a record of processing activities, whether the vendor is in your data processing agreement (DPA), and whether a subject access request can reach the copies. A detector that keeps the body in your process removes that question rather than answering it. For more information, see GDPR and CCPA compliance for LLM applications.
The threat detection half
Threat detection for AI applications covers a narrower set of risks than the phrase suggests:
- Prompt injection and jailbreaks in user messages and in retrieved content.
- Sensitive data moving in a direction it shouldn't, inbound or outbound.
- Unsafe content in inputs or outputs.
- Automated abuse of the endpoints that the application exposes.
- Anomalous agent behavior across a session.
Different products focus on different rows. Lakera, HiddenLayer, Pillar, and Straiker focus on the first and third. Presidio and in-process classifiers focus on the second. Edge and application-layer bot products cover the fourth. Trace-based tools cover the fifth.
The detection ceiling is the same everywhere: an injection phrased as a plausible business request carries no attack pattern. Every vendor's benchmark runs against attacks that someone already characterized. Treat published accuracy as a floor for known shapes, not as a statement about the attacks aimed at you.
That ceiling is why detection quality can't be the only axis. A workflow in which a missed detection still can't produce an unauthorized refund is in a better position than one with a better classifier and an open tool.
Getting both without a trade
The practical resolution is to place each control where it costs the least privacy for the coverage that it buys.
Sensitive-data classification is a pattern-and-model problem on text that you already hold, and it has no reason to leave. The following check does that with Arcjet's local sensitive-information rule. launchArcjet creates the client, localDetectSensitiveInfo is configured once with the classes to deny, and arcjet.guard() evaluates it against the message in your own process, so the text is classified without leaving:
import { launchArcjet, localDetectSensitiveInfo } from "@arcjet/guard";
const arcjet = launchArcjet({ key: process.env.ARCJET_KEY! });
const piiCheck = localDetectSensitiveInfo({ deny: ["CREDIT_CARD_NUMBER", "EMAIL", "PHONE_NUMBER"],});
export async function screenMessage(message: string, session: Session) { const decision = await arcjet.guard({ label: "chat.inbound", actor: session.userId, rules: [piiCheck(message)], });
// The message doesn't leave this process to be classified. return { blocked: decision.conclusion === "DENY" };}Authorization needs no content inspection at all. It needs the session and the arguments, and both are local by definition.
Prompt-injection detection is the control that benefits from a hosted model. Decide deliberately whether that model runs locally at a cost in accuracy, or remotely at a cost in data flow. Either choice is defensible. Making it by accident isn't.
How to evaluate a combined platform
Ask a combined platform eight questions, per control rather than per vendor.
Which bytes leave, for this check? Full text, a hash, or metadata.
Where are they processed and retained? Region, duration, and whether they train anything.
Is the vendor a subprocessor under your DPA? If your customers' data reaches them, they are.
Can this control run without network egress? If yes, what accuracy does that cost.
What's the false-positive rate on your traffic? Not the benchmark. Run it in dry-run mode for a week.
Does a detection change the outcome, or record it? If the tool still executes, it's detection.
What happens on timeout, and can you choose per action? A search can fail open. A transfer must not.
Is the decision auditable? Actor, action, rule, verdict, correlation ID.
How to choose
If data residency is the binding constraint, because of regulated data, a strict DPA, or a customer contract that names subprocessors, then start from what can run in your process, and accept that authorization fills the remaining detection gaps rather than a better classifier. Arcjet is built for this shape: local sensitive-info inspection plus in-process allow-or-deny at the action.
If detection breadth is the binding constraint and your data is low-sensitivity, then a hosted specialist is likely to score better on known attack shapes than a model that you run locally. Take it, and be accurate in your data map about what you've sent.
If you're regulated and adversarial at once, then it's two products with a clear split: local inspection for anything that contains customer data, hosted detection for content that doesn't, and enforcement at the action in both cases. For the sector-specific versions, see AI security for fintech and AI security for healthcare and regulated industries.
For the deployment-model comparison in detail, see PII detection at runtime: gateway versus application.
Frequently asked questions
What's the best AI security platform for data privacy and threat detection?
It depends which half is load-bearing. If data residency binds, then start from what can run in your process and fill the remaining detection gaps with authorization. If detection breadth binds and your data is low-sensitivity, then a hosted specialist is likely to score better on known attack shapes.
Why do data privacy and threat detection conflict?
Detection improves with more content: the more of the prompt, document, and tool result a classifier sees, the better it scores. Privacy wants that content to stay put. A hosted detector resolves this by receiving the text, which is the data you were protecting.
Which controls can run without sending data out?
Authorization needs no content inspection at all, only the session and the arguments. Sensitive-data classification is a pattern-and-model problem on text you already hold and has no reason to leave. Prompt-injection detection is the one that genuinely benefits from a hosted model.
Does trace-based evaluation affect data privacy?
Yes. Adding prompt content to spans so an evaluator can judge them means your observability vendor holds the prompts, under whatever retention that tier has. It becomes a data processor.
What should I ask a combined platform?
Ask per control: which bytes leave, where they're processed and retained, whether the vendor is a subprocessor under your DPA, what the false-positive rate is on your own traffic, whether a detection changes the outcome or records it, and what happens on timeout.
AI runtime security in your code
Protect your AI agent workflows with Arcjet
Arcjet classifies the body in your own process and returns a decision, so the data you are protecting never leaves to be scanned.