> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getunbound.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Policies

> Protect sensitive data with guardrails that detect, redact, or block PII, secrets, and restricted content

## What are Security Policies?

Security policies are guardrails that protect sensitive data flowing through AI tools in your organization. They automatically detect, redact, or block content like personally identifiable information (PII), API keys, passwords, and restricted terms before it reaches an LLM.

**Dashboard:** [gateway.getunbound.ai/policies/security-policies](https://gateway.getunbound.ai/policies/security-policies)

## Available Guardrails

### PII Detection

Detects personally identifiable information across 20+ identifier types — names, email addresses, and phone numbers, plus international identity documents such as passports, national ID cards, and tax numbers spanning the US, UK, EU, India, and Australia. Configure an action per PII type:

* **Block** — Reject the request entirely
* **Redact** — Replace detected PII with placeholders before sending to the model (only supported in Unbound gateway mode)
* **Audit** — Log the detection but allow the request

### Secrets Detection

Automatically identifies credentials — API keys, database connection strings, and cryptographic keys — in prompts and responses. Prevents accidental exposure of sensitive credentials to LLM providers.

## Setting Up Security Policies

1. Go to [Security Policies](https://gateway.getunbound.ai/policies/security-policies) in the Unbound dashboard
2. Click **Create Policy**
3. Enable the guardrails you want (PII, Secrets) and set an action for each
4. Optionally scope the policy to specific [user groups](https://gateway.getunbound.ai/users/user-groups)
5. Save your configuration

<Note>
  Security policies are applied to requests before they leave your gateway. Redacted content is replaced with placeholders, so the original data never reaches the LLM provider.
</Note>

<Note>
  Beyond block/redact/audit, security policies can also **route** sensitive requests to an alternate model. Routing is configured as a separate sub-type — `default-routing` and `error-code-routing` — via the [CLI](/cli/policies) or policy API rather than the guardrail action toggle.
</Note>

## Applying to Users

By default, a security policy with no user groups applies to **everyone** in your organization. To restrict a policy to specific teams, assign it to one or more [user groups](https://gateway.getunbound.ai/users/user-groups) during creation or editing.

## Managing via CLI

List and manage security policies from the terminal:

```bash theme={null}
unbound policy list --type SECURITY
unbound policy get <policy-id>
```

<CardGroup cols={2}>
  <Card title="CLI Policy Management" icon="terminal" href="/cli/policies">
    Create and manage security policies from the terminal
  </Card>

  <Card title="Analytics" icon="chart-line" href="/analytics">
    Review guardrail hits and security events in the dashboard
  </Card>
</CardGroup>