Outband is a 12MB sidecar that generates SOC 2 evidence from every LLM API call — inside your VPC, with sub-millisecond overhead. No Redis. No external databases. No control plane.
The sidecar runs on localhost. Your request never leaves the machine before hitting the upstream API. No DNS resolution, no TLS handshake to a gateway, no routing through a third party's load balancer. The hot path is a single io.Read wrapper.
No telemetry sent to us. No external database. No license server for the free tier. The only outbound connection is to your configured LLM API. If our company disappears tomorrow, your sidecar keeps running.
Gateways give you database rows. Outband gives you SHA-256 hash chains with timestamp binding, mapped to SOC 2 CC6.1, CC6.6, CC9.2 and ISO 42001. An auditor can verify the chain independently. Nobody — including you — can alter the evidence after the fact.
* Benchmarked on Apple M2, Go 1.26.1, local httptest.Server isolating proxy overhead from network variance. Full benchmark data.
docker compose up — try it in 2 minutes
A DevOps engineer can read the entire source, deploy it, and hand the first evidence summary to compliance — all before lunch.
| Outband | AI Gateway (SaaS) | AI Gateway (Self-hosted) | DIY Logging | |
|---|---|---|---|---|
| Network egress required | No | Yes — all traffic | Depends on config | No |
| External databases | None | Vendor-managed | Redis + blob storage | You build it |
| Binary / deployment size | 12MB static binary | N/A (hosted) | Helm chart + dependencies | Varies |
| Latency overhead | <1ms (localhost) | 50–100ms (network hop) | 10–30ms (in-VPC) | ~0 (in-process) |
| Cryptographic audit trail | SHA-256 hash chains | Database rows | Database rows | None |
| SOC 2 evidence mapping | CC6.1, CC6.6, CC9.2 | Varies | Varies | Manual |
| Data sovereignty | Your VPC only | Third-party infra | Your VPC | Your VPC |
The sidecar runs in your trust boundary, not ours. We built it to be auditable.
The sidecar has access to the same data your application already handles. It does not expand your attack surface. Full threat model.
Apache 2.0. CI runs go test -race on every commit. No obfuscation, no binary blobs. Read the source.
If the audit pipeline is under load, the proxy continues forwarding. Drops are counted in every evidence summary. Security policy.
Security issues: security@outband.io. 48-hour acknowledgment. 7-day assessment. Coordinated disclosure.
The open source tier is the full audit pipeline, not a trial. Enterprise pricing scales to your environment.
Future features labeled honestly. The free tier is not a trial.
An architectural approach to SOC 2 and ISO 42001 in LLM-powered applications. Covers the sidecar architecture, evidence schema, control mapping, and deployment model.
Read WhitepaperQuestions about enterprise features, deployment, or compliance requirements? We respond within 24 hours.
contact@outband.io