Please rotate your device
To continue exploring this website, please rotate your device to a vertical orientation
Understand model behavior
Baseten and Goodfire are working to surface safety signals inside supported open models during inference - helping teams identify risky behavior and decide when to intervene.
Set boundaries for agents
Baseten supports NVIDIA OpenShell in its sandbox cloud so teams can apply boundaries around credentials, files, network access, and tools outside the agent’s own code.
Advance safer open models
Base Labs develops and shares research on training, monitoring, and evaluating open models. Baseten connects that work to production infrastructure, helping turn research into practical approaches to model safety.
Security built into the whole stack
Trust across the entire AI stack
- 01
Protect the workload
Run sensitive inference with encryption, workload isolation, and clear data-retention practices. Align networking and deployment choices with your security requirements.
- 02
Govern access and change
Control who can deploy, configure, and operate production AI. Use enterprise identity, role-based permissions, and reviewed release workflows to keep access and changes accountable.
- 03
Address model risk
Safety extends beyond protecting data. Evaluate models for your use case, define acceptable behavior, and plan how your application should respond to unsafe outputs, sensitive-data exposure, or attempts to redirect it.
- 04
Put boundaries around actions
A model’s response should not become unrestricted permission to act. Define which tools, data, and systems an agent can reach—and where sensitive actions require validation or human approval.
Secure Foundation
Enterprise security controls.
Zero data retention by default
Serve models with zero retention of inference inputs and outputs, plus encryption in transit and at rest. Protect sensitive customer and proprietary data as models run.
Manage access
Centralize authentication with SSO and manage permissions with role-based access controls. Use service accounts to automate workflows without sharing human credentials.
Deploy in your region
Select a region for your GPU model deployment and keep every replica in that region. Route requests through a regional endpoint to support your data residency and compliance requirements.
Protect data and artifacts
Securely connect your data with native cloud IAM integrations. With BYOK encryption, exercise independent control over access to model weights and payloads.
Constrain network exposure
Enforce isolation and segregation through fine-grained network policies. Control how workloads connect to keep production traffic aligned with your security guidelines.
Simplify the security review
Streamline your security review with SOC 2 Type II attestation, HIPAA support with a BAA, and supporting documentation in the Baseten Trust Center.
Secure production
Restrict who can change production, keep experimentation separate, and version, promote, and roll back deployments with supported workflows.
Networking & deployment
Scale fast. In our cloud, or in yours.
Baseten Cloud Fully managed
Scale with demand
Configure autoscaling to match your workload, and scale to zero when a model has no traffic. Baseten’s global compute fleet supports rapid scaling without capacity planning.
Protect inference data
Inference traffic routes directly to your workload plane, and Baseten does not store synchronous inference inputs or outputs. For asynchronous requests, inputs are stored until the request runs.
Dedicated infrastructure Managed by Baseten
Connect without the public internet
Route inference traffic from your VPC to your dedicated environment using AWS PrivateLink or Google Cloud Private Service Connect.
Get infrastructure built for your workloads
Work with Baseten to select regions, GPU types, and capacity commitments that meet your needs. Baseten procures and operates the capacity for your dedicated environment.
Your cloud, your control.
Keep model weights in your control
Pull model weights from a private source you control. Work with the Baseten team to configure a customer-owned weights bucket.
Keep inference data in your environment
Model inputs and outputs stay inside your infrastructure. Baseten does not store synchronous inference payloads; asynchronous inputs queue in your environment until the request runs.
Related resources
- News
- News
- Infrastructure
How we built RBAC that scales for the enterprise
Matt Howard, Samiksha Pal, Rachel Rapp - AI engineering
Private, secure DeepSeek-R1 in production in US & EU data centers
Yineng Zhang, Amir Haghighat, Philip Kiely
FAQ
Frequently asked questions about security on Baseten
Baseten provides zero data retention for model inputs and outputs on synchronous inference, across Model APIs and Dedicated Inference. Async inference inputs are temporarily stored until processing completes, for up to 72 hours, then deleted; outputs are not stored. Operational metadata, such as latency and request size, is retained separately from inference content.
Customer content, such as model inputs, outputs, and weights, is your data. Baseten does not use customer content to train or fine-tune models.
No. Your prompts and outputs aren't sent to the model developer. When you run a model on Baseten, including an open-weight model, inference is served on Baseten infrastructure.
Production data stored on Baseten-managed volumes is encrypted at rest. Customer content sent to Model APIs or Dedicated Inference is encrypted in transit.
Zero data retention applies to model inputs and outputs—not every operational record. Baseten retains inference metadata, such as response times, request sizes, and request volume, to support platform operations.
Yes. Baseten supports SSO and role-based access controls to help govern access to production AI systems. Teams can centralize authentication and manage permissions for the people operating their deployments.
Baseten offers private connectivity and deployment options for workloads that require tighter network boundaries. Self-hosted inference runs the workload plane inside your VPC, with requests to your own domain routed directly to it while Baseten operates the control plane. Our engineers can help scope the network architecture and connectivity options for your environment.
Yes. Dedicated deployments can be configured for regional requirements, including US or EU deployment. Baseten-managed compliance policies can restrict the regions where inference workloads run. Model API availability and residency commitments depend on the endpoint and agreement, so discuss your requirements with our team before deploying.
Baseten uses encryption, access controls, and workload isolation to protect model artifacts and production deployments. Model weights can be loaded from sources such as Hugging Face, GCS, or S3; weight caching is separate from inference input/output retention, and deleting a model automatically permanently deletes any cached weights.
Security protects the systems AI runs on: data, identities, networks, and deployments. Safety addresses how models and agents behave, including risky outputs, prompt injection, and actions outside policy. Baseten combines a secure serving foundation with work on model-behavior monitoring, agent-runtime controls, and open safety research. These layers complement one another; no single control guarantees safe behavior.
Baseten and Goodfire have announced a partnership to bring activation-based safety monitoring into inference for selected open models. The productized offering is in development, not generally available. The goal is to give applications signals about risky model behavior that they can use according to customer-defined policy. Contact our team to discuss your use case and current availability.
Baseten supports running NVIDIA OpenShell inside its sandboxes through a template. OpenShell applies policy around credentials, file access, and outbound networking outside the agent’s own code. The Carbon sandbox infrastructure described in our launch is in private preview. Talk to our team about the runtime controls and availability for your workload.
Visit the Baseten Trust Center to view public materials and request access to security documentation, including our SOC 2 report, penetration-test report, and data-retention policy. Access to restricted documents requires approval and an NDA. Our team can also help with security questionnaires, architecture reviews, and BAA or DPA requests.
Ready to bring AI to production securely?
Talk through your security review with our team, or get a live walkthrough of the controls on this page.
