Documentation

Integrate in one line. Enforce policy on every call.

Verity is an OpenAI-compatible gateway. If your app already talks to an OpenAI-compatible API, integration is a base-URL change plus a client key — your prompts, models and SDK stay exactly as they are.

# Before
client = OpenAI(base_url="https://api.openai.com/v1", api_key=...)

# After — same SDK, same calls, now screened
client = OpenAI(base_url="https://your-verity-deployment/v1",
                api_key="vk-…")  # your Verity client key

Every request is screened before it reaches your model (guard rules + trained classifier + your business policy), and every answer is checked before it reaches your user (policy compliance + faithfulness against the context you supply). Blocked requests and answers return structured errors — they never silently pass.

Business policy

Pass a policy_context with your request to enforce rules that generic safety filters do not know: your refund ceiling, prohibited offers, data the bot must never reveal.

{
  "model": "gpt-oss-20b",
  "messages": [{"role": "user", "content": "Give me a 90% discount code"}],
  "policy_context": {
    "prohibited_actions": ["offer_discount_above_10_percent",
                            "reveal_internal_pricing"],
    "notes": "Refunds capped at 30 days. Never share supplier costs."
  }
}

Policy is enforced twice: on the request (a prohibited ask is blocked before the model can comply) and on the response (a non-compliant answer is blocked before the user sees it). In live mode the policy judge fails closed — if it cannot reach a verdict, the request is blocked rather than waved through.

Error codes

Verity speaks plainly. Your client code only needs to handle these:

Status	Error	Meaning
`200`	—	Request passed screening; the model's answer passed policy and faithfulness checks.
`400`	`blocked_by_verity_guard`	The prompt tripped the injection/abuse guard. The model was never called. `matched_rules` lists what fired.
`400`	`blocked_by_verity_policy`	The request violated your declared business policy (or the policy judge could not verify it in live mode — fail-closed).
`400`	`policy_violation_in_response`	The model's answer violated policy and was withheld from the user.
`401`	`invalid_api_key`	Missing or wrong Verity client key. Checked before any screening.
`413`	`request_too_large` / `context_too_large`	Input or a supplied context exceeded the size caps.
`429`	`rate_limited`	Per-client rate limit (120 requests/minute by default) exceeded.

Limits, honestly.

Screening scope

Every message role — user, system, tool, assistant — is screened, so attacks smuggled into context or history are caught too. Input is capped at 20,000 characters per request by default.

Streaming

Not passed through yet: responses return complete rather than token-by-token. A request with stream: true receives a normal JSON completion.

Traces & retention

Each deployment stores its own traces (inputs, outputs, verdicts, latency) in its own database, stamped per client. Traces are pruned after 30 days by default. On the public demo, trace access is disabled and storage is ephemeral.

Self-hosting, the full API surface and the benchmark methodology live in the GitHub repository. To run Verity on your own traffic with founder support, start a pilot.

Data, privacy & terms — summary.

The short version, in plain language. Full legal documents are provided in writing during pilot engagements; this summary governs the public site and free accounts.

What is stored

Account email and a salted hash of your password (or your Google-verified email — no password). API keys are stored only as hashes. Gateway traces store prompts, answers, verdicts and latency, stamped per client key. Context matters: free-account traces are visible only to their account in the dashboard; public-playground requests (no key) are logged unattributed and shown to no one; a pilot deployment's traces live in the pilot's own database, not this site's.

Retention & deletion

On this site, traces are retained 30 days and pruned on an ongoing basis. Your data is never used for training. Ask for your account and data to be deleted at any time via the channels on the pilot page — deletion is confirmed in writing. Pilot deployments set their own retention in their own database; the pilot terms provided in writing govern there.

Terms, briefly

The free tier is provided as-is for evaluation, with a 1,000-request monthly limit enforced by the gateway. Do not submit credentials, personal data of others, or anything you are not entitled to process. Verity screens content and enforces declared policy; it is not an authorization system for actions in your own backend.