Control catalogue
Named controls give reviewers stable references. Scope distinguishes core capabilities from those configured or delivered per deployment. Framework mappings indicate support for requirements; they are not certification.
Detection
6 controls| Code | Control | OWASP LLM Top 10 | NIST AI RMF | ISO 27001 Annex A |
|---|---|---|---|---|
| SC-01 | Sensitive-data detection: validated rules, specialised models and a contextual verifier; optional finance and telecom semantic policiesCore detection; semantic policies on request | LLM02 | Measure | A.8.12 |
| SC-02 | National identifier validators: TCKN checksum, VKN, IBAN mod-97, LuhnRejects look-alike numbers. | LLM02 | Measure | A.8.12 |
| SC-03 | Telecom identifiers: IMSI, ICCID, IMEI, MSISDN, coordinates | LLM02 | Measure | A.8.12 |
| SC-04 | Contextual verification of supported candidate types to remove false hits | LLM02 | Measure | A.8.12 |
| SC-05 | Organisation-specific identifier formats delivered for the agreed workflowDelivered per deployment | LLM02 | Govern | A.5.12 |
| SC-06 | Local file protection with agreed format handling; optional vision-language OCR for scanned pagesCore file handling; OCR on requestImages are never forwarded. Only protected text continues from scans; unreadable or incomplete pages follow the agreed refusal policy. | LLM02 | Manage | A.8.12 |
Protection and restoration
6 controls| Code | Control | OWASP LLM Top 10 | NIST AI RMF | ISO 27001 Annex A |
|---|---|---|---|---|
| SC-07 | Context tokenisation: opaque per-case tokens, one token per entity | LLM02 | Manage | A.8.11 |
| SC-08 | Format-preserving encryption mode, opt-in, key held by the customer | LLM02 | Manage | A.8.24 |
| SC-09 | Restoration inside the perimeter, scoped to the case | LLM05 | Manage | A.8.11 |
| SC-10 | Fail-closed: protection failure or unreadable input stops the request | LLM02 | Manage | A.8.12 |
| SC-11 | Gateway guardrail: streaming protect and restore for gateway-fronted traffic | LLM02LLM05 | Manage | A.8.12 |
| SC-12 | Endpoint deployment with human review before send | LLM02 | Manage | A.8.12 |
Tenancy, identity, operations
4 controls| Code | Control | OWASP LLM Top 10 | NIST AI RMF | ISO 27001 Annex A |
|---|---|---|---|---|
| SC-13 | Tenant-scoped API keys and organisation isolation | LLM10 | Govern | A.5.15A.8.3 |
| SC-14 | Rate limiting and distributed ledger | LLM10 | Manage | A.8.6 |
| SC-15 | Administrator console, local accounts, API-key lifecycle | — | Govern | A.5.16 |
| SC-16 | Review of recorded detection runs; no silent model retraining | LLM02 | Measure | A.8.16 |
Evidence and audit
5 controls| Code | Control | OWASP LLM Top 10 | NIST AI RMF | ISO 27001 Annex A |
|---|---|---|---|---|
| SC-17 | Security event logging: ECS JSON with stable codes to your SIEM, no values reprinted | — | Govern | A.8.15 |
| SC-18 | Detection-run review records in PostgreSQL, best-effort with loss alerts | — | Govern | A.8.15 |
| SC-19 | Service metrics (OpenMetrics) | — | Measure | A.8.16 |
| SC-20 | Restore evidence: who restored which token, when, and in which case | LLM05 | Govern | A.8.15 |
| SC-21 | Finding detail: class, confidence, detector, verifier result and replacement | — | Govern | A.8.15 |
Deployment and supply chain
4 controls| Code | Control | OWASP LLM Top 10 | NIST AI RMF | ISO 27001 Annex A |
|---|---|---|---|---|
| SC-22 | In-perimeter delivery: private Helm deployment for Kubernetes and OpenShift, including mirrored registries | LLM03 | Govern | A.5.23A.8.9 |
| SC-23 | Release manifest with pinned model and image hashes, and CycloneDX SBOMCore artefacts; signing configured | LLM03 | Govern | A.5.21 |
| SC-24 | No Salus-side data, keys or telemetry | LLM02 | Govern | A.5.23 |
| SC-25 | CPU-only text detection; optional OCR and semantic policies use GPU acceleration | — | Manage | A.8.6 |
Administration and operations
Administration console
Console for organisations, keys, permissions, rate limits, policy and detection review. Languages and administrative integrations are configured per deployment.
Your directory, your roles
Active Directory, LDAP or single sign-on can be configured for the deployment. Map your groups to roles and separate administration, review and restoration permissions.
Policy per workload
Agree the categories, handling actions and identifier formats for each workflow. Organisation-scoped API keys and permissions control calling systems.
Security and review evidence
Security events carry stable codes without sensitive values. Review runs are recorded in your PostgreSQL on a best-effort path, with loss alerts; values are encrypted with your key and retained under your policy.
Monitoring you already have
OpenMetrics on every service. Dashboards and alerts are delivered in your monitoring platform, with a documented CEF mapping for your security collector.
Compute sized for the workload
Core text detection runs on CPU. Scanned-page OCR and the optional Semantic Layer use GPU acceleration. Capacity and availability are sized for the agreed deployment.
Models and rules are versioned artefacts pinned to each release. A release is either active or rolled back; nothing retrains silently.
Agree the applicable controls and delivery scope for your deployment. Additional framework mappings are supplied where agreed; no certification is claimed.
Deliberately out of scope: prompt-injection classification, agent and tool control, retrieval access control, brand and toxicity filtering, red teaming of models. Salus is the data-transformation layer under those tools, not a replacement for them.