AI safety & content filtering

Every AI request and response in Crux passes through a security gateway before it reaches a model or your workspace.

PII redaction

Personally identifiable information detected in AI inputs and outputs — email addresses, phone numbers, government ID numbers, financial account numbers — is automatically redacted before processing where possible. Research often contains participant details; this layer reduces the risk of them leaking into AI context.

Secret detection

API keys, access tokens, and private keys pasted into notes or documents are detected and redacted so credentials don't end up in prompts or generated output.

Abuse and injection blocking

Requests attempting prompt injection, jailbreaking, credential exfiltration, or harmful content generation are blocked automatically. This includes injection attempts hidden inside uploaded documents — important when you're processing material from outside your org.

Audit logging

Security-relevant decisions (blocks and redactions) are logged for operational review. The logs record the decision, not the redacted content itself.

What this means for you

You don't need to sanitise research before uploading — but good hygiene still helps: avoid uploading credentials, and use participant codes instead of full names where your research protocol requires it.

One path, whichever model you pick

Choosing Fast, Sharp, or Capable in the Agent changes how hard the model thinks, not where your content goes. Every option is a Crux-managed model called server-side through the same gateway, with the same redaction and injection checks in front of it. There is no way to point Crux at your own key or an unvetted provider, so no setting can route project content around these checks. See AI requests and models.

Related

• Data security & privacy
• Terms of use