Security
Last updated: April 29, 2026
Version 2026-04-29 · Effective April 29, 2026
This page describes how Costa Security Inc. (“Costa”) secures the Costa Platform and Customer data. For contractual security commitments, see our Cloud Service Agreement and Data Processing Addendum.
What Costa Is — and Is Not
Costa is an AI gateway and observability platform. It sits between your AI coding agents and third-party model providers (Anthropic, OpenAI, Google, and others).
Costa does not:
- Generate AI content
- Train AI models
- Store your prompts or responses beyond the configurable retention window
- Sell or share your data
Costa does:
- Proxy and route your agent requests
- Scan requests with Tool Defender (AST-based security analysis)
- Record session metadata and thread content for your observability
- Enforce RBAC, token isolation, and budget controls
Encryption
| Layer | Standard |
|---|---|
| Data in transit | TLS 1.2+ on all connections |
| Data at rest | AES-256 |
| Key management | HSM-backed; keys rotated regularly |
| Provider Tokens (customer API keys) | AES-256 at rest; never logged in plaintext |
Access Controls
- RBAC — role-based least-privilege access for all internal systems
- MFA — required for all Costa team members accessing production
- Token isolation — each Costa API token is a separate identity with isolated thread history and usage tracking
- Audit logging — all access to Customer data is logged with timestamp, actor, and action
- Quarterly access reviews — standing access is reviewed and revoked when no longer needed
Tool Defender
Tool Defender is Costa’s AST-based security scanning engine. It analyzes agent tool calls and requests in real time, flagging:
- Prompt injection attempts
- Sensitive data exposure (PII, credentials, secrets)
- Suspicious tool call patterns
- Policy violations
Important: Tool Defender operates on a best-effort basis. It does not warrant detection of all threats. Customers should implement additional defense-in-depth appropriate to their use case. Tool Defender’s detection rules are Costa’s trade secrets and may not be reverse engineered.
Data Handling
| Data Type | Default Retention | Configurable |
|---|---|---|
| Interaction Metadata | Subscription Period + 60 days | Enterprise (per Order Form) |
| Thread Content | 30 days | Yes (Costa settings) |
| Billing Data | 6 years | No (tax/audit requirement) |
| Provider Tokens | Until revoked by customer | N/A |
| Security Scan Results | Same as Interaction Metadata | Enterprise (per Order Form) |
No training: Costa never uses your prompts, responses, or thread content to train any AI/ML model. This applies to all tiers including free. See Cloud Service Agreement for the full legal commitment.
EU data residency: Customers using eu.costa.app have all data processed and stored exclusively within the EEA.
Infrastructure
- Cloud provider: Amazon Web Services (AWS)
- Regions: US (us-east-1, us-west-2), EU (eu-west-1)
- Orchestration: Kubernetes (EKS)
- Availability: Multi-region replication; automated failover
- Backups: Automated with documented recovery procedures
- Monitoring: Grafana; Sentry for error tracking
Compliance
| Standard | Status |
|---|---|
| SOC 2 Type II | In progress |
| GDPR | Compliant — see DPA |
| CCPA / CPRA | Compliant — see Privacy Policy |
| EU AI Act (Article 3) | Costa operates as intermediary, not AI Provider |
| EU Data Act | Data portability commitments in CSA |
SOC 2 report available under NDA — request at security@costa.app.
Incident Response
- Documented incident response plan with defined roles and escalation paths
- 72-hour breach notification target for Personal Data breaches (GDPR Art. 33 compliant)
- Annual tabletop exercises
- To report a security incident: security@costa.app
Vulnerability Disclosure
Costa operates a responsible disclosure program.
- Scope: costa.app, ai.costa.app, eu.costa.app, and the Costa API
- Contact: security@costa.app
- Safe harbor: Costa will not pursue legal action against researchers acting in good faith within scope
- Response SLA: Initial acknowledgement within 2 business days; triage within 5 business days
- Out of scope: Social engineering; physical attacks; denial-of-service
Penetration Testing
Costa conducts annual third-party penetration testing. A summary of findings and remediation status is available under NDA upon request at security@costa.app.
Security Questionnaires
Costa accepts CAIQ, SIG, VSAQ, and custom questionnaires. Response SLA: 5 business days. Contact enterprise@costa.app.
Subprocessors
See trust.costa.app for the full list of subprocessors, their locations, and GDPR posture.
Contact
Security incidents and vulnerability reports: security@costa.app Enterprise security reviews and questionnaires: enterprise@costa.app Privacy and data subject rights: privacy@costa.app
Changelog
| Version | Date | Summary |
|---|---|---|
| 2026-04-29 | April 29, 2026 | Initial version. |