← Safety

LakeraLakera

Lakera

云端Cloud 商业Commercial guardrailsguardrails APIAPI 多平台Multi-platform partial lifecycle: active 核验Checked 2026-11-06

核验标记表示资料完整度，不是产品评分。下列未确认项可能影响选型；请按对应来源逐项确认。The confidence mark describes evidence completeness, not a product score. Unconfirmed items below may affect your choice; check them against the relevant sources.

未确认的信息Information not confirmed

客户 prompt / 响应内容的留存期、删除路径与是否用于模型训练（条款未逐条区分）
合规证书与审计材料（SOC 2、ISO 27001、DPA、subprocessor 清单）：当日抓到的页面未点名
私有化 / 自托管形态是否存在
商业档位结构与额度（pricing 跳转页当日未渲染出正文）
底层检测模型能否替换或自选档位
MCP 集成的具体传输形态与工具审批语义
红队评估项目的周期、并发与交付格式
大陆网络直连可用性与备案情况（未实测、未检索）

Retention period, deletion path and training use of customer prompt/response content (the terms do not address it separately)
Compliance certificates and audit material (SOC 2, ISO 27001, DPA, subprocessor list): not named on the pages captured
Whether a private or self-hosted form exists
Commercial tier structure and quotas (the pricing redirect did not render tier text)
Whether the underlying detection model can be replaced or chosen
The concrete MCP integration transport and tool-approval semantics
Red assessment turnaround, concurrency and deliverable format
Mainland-network direct reachability and filing status (not measured, not searched)

English summaries and interface labels are available. Detailed source notes below are currently in Chinese.

Lakera 是「托管在厂商侧」的那一层 AI 安全：官网自我定位 "The AI-Native Security Platform"，产品面分 Workforce AI Security、AI Agent Security、AI Red Teaming 三条；工程侧能看到的是 platform.lakera.ai 的控制台加 api.lakera.ai 的 Bearer API。和本大类另外两份红队档案的分工很直白：garak 与 PyRIT 是「你自己跑、跑完留证据」， Lakera 是「你的请求每次经过它、它给一个 flagged 判定并允许你选择阻断还是留档」。当日另一个必须记的事实是 归属与条款入口已经统一到 Check Point（privacy 与 security 都 301 过去）。

适合与不适合When to use it, when not to

适合：要在链路里实时管住 prompt injection / jailbreak / PII 泄露 / 违规内容，并接受检测跑在厂商侧；策略需要按项目在「block the interaction」与「logging for investigation」之间切换；栈里已经有 Amazon Bedrock、Google Cloud、 Microsoft Copilot Studio、Salesforce Agentforce、n8n、Relevance AI 或 MCP server。不适合：必须离线或私有化（未取到该口径）、要替换或自选底层检测模型、只想跑一轮可复现扫描留工程证据、以及需要自助开通的红队评估（Red 需联系团队）。

中文生态China availability 国产 / 国内可直接用 / 备案状态 · 快照domestic / direct access / CAC filing · snapshot 2026-11-06

出品属地Origin: 国外出品foreign-made　当日在册的属地证据只有官网页脚与隐私条款跳转指向 Check Point 主体；Lakera 自身的注册主体与国籍背景本批次未逐条核验，故按 foreign 记录。The only locality evidence on record the same day is the site footer and the privacy redirect pointing at the Check Point entity; Lakera's own registering entity and nationality background were not verified item by item, so it is recorded as foreign.
国内使用Direct access: 直连未核验direct unknown　lakera.ai、docs.lakera.ai 与 checkpoint.com 当日从当前网络取到 200/301，但未在大陆网络环境做直连实测，故记未知。lakera.ai, docs.lakera.ai and checkpoint.com returned 200/301 from the current network on the verification date, but no mainland-network direct-connection measurement was made, so it is recorded as unknown.
备案状态CAC filing: 备案未核验filing unknown：无官方依据，本批次未检索生成式 AI 备案公示，不下「未备案」结论。No official basis; the generative-AI filing registry was not searched in this pass, so no "not filed" conclusion is drawn.

备案信息以网信办《生成式人工智能服务已备案信息》公示名单为准（按批次滚动更新，本站只抄编号不解读）；「大陆可直连」是本站从大陆网络直连实测的结果，不是厂商承诺。GitHub 类站点当日实测有波动，口径写在依据里。Filing status is quoted from the CAC public registry (updated batch by batch; this site copies the number and does not interpret it). "Direct access" is this site's own reachability measurement from a mainland network, not a vendor promise. GitHub-hosted sites fluctuated on the measurement day — the note says so.

固定坐标系Fixed coordinate system

8 个维度dimensions, 与同分区其他对象逐项可比each comparable item by item against others in the same section.

模型与开放条件Model & openness: 它守与评的不是某一家模型，而是你的应用链路：文档把 Amazon Bedrock、Google Cloud、Microsoft Copilot Studio、 Salesforce Agentforce、n8n、Relevance AI 与 MCP servers 列为集成面。Guard API 收下的是文本（POST 带 messages 与 project_id），不是权重；底层检测模型能否替换、能否自选档位：官方未披露，API Reference 只在响应的 developer 信息里给 git_revision 与 model_version 两个字段。
What it guards and evaluates is not one vendor's model but your application chain: the docs list Amazon Bedrock, Google Cloud, Microsoft Copilot Studio, Salesforce Agentforce, n8n, Relevance AI and MCP servers as integration surfaces. The Guard API takes text (a POST with messages and project_id), not weights; whether the underlying detection model can be swapped or a tier chosen: not disclosed officially — the API Reference only exposes git_revision and model_version inside the response's developer info.
运行位置Where it runs: 云侧交付：注册与配置在 platform.lakera.ai，检测走 api.lakera.ai 的托管 API，鉴权形式是「Authorization: Bearer $LAKERA_GUARD_API_KEY」，官方 quickstart 的调用是 POST https://api.lakera.ai/v2/guard。官网自我定位「The AI-Native Security Platform」，产品面写作 Workforce AI Security、AI Agent Security、AI Red Teaming。本机或私有化形态：本批次未取到官方口径，记未知。
Delivered from the cloud: sign-up and configuration at platform.lakera.ai, detection through the hosted API at api.lakera.ai, authentication of the form "Authorization: Bearer $LAKERA_GUARD_API_KEY", and the official quickstart call is POST https://api.lakera.ai/v2/guard. The site self-describes as "The AI-Native Security Platform", with product lines Workforce AI Security, AI Agent Security and AI Red Teaming. A local or private-deployment form: no official statement captured in this pass, recorded as unknown.
本地文件Local files: 本机不落地：prompt 与响应由你的应用发出与收回，判定结果可在控制台的 Guard 结果面回看（文档列 /guard 与 /guard/results 两个端点）。命中记录的导出格式、保留时长与删除方式：官方在册页未逐条给出，进 unknowns。
Nothing lands locally: prompts and responses are sent and returned by your application, and decisions can be reviewed in the console's Guard results surface (the docs list the /guard and /guard/results endpoints). Export format, retention duration and deletion path for hit records: not given item by item on the pages on record, moved to unknowns.
关机后的任务Tasks after shutdown: 两类异步要分开读：Guard 是同步 API 调用，官方口径是实时筛查；Red 是一次托管评估项目，文档写四步流程（enumeration、attack development、impact testing、reporting），交付「detailed findings with remediation guidance」。项目时长、并发上限与结果通知机制：官方未说明。
Two kinds of asynchronous behaviour must be read separately: Guard is a synchronous API call that the official framing describes as real-time screening; Red is a hosted assessment project, documented as four steps (enumeration, attack development, impact testing, reporting) delivering "detailed findings with remediation guidance". Project duration, concurrency limits and result notification: not stated officially.
工具与扩展Tools & extensions: API 面两个端点在册（/guard 与 /guard/results），响应含 flagged 布尔判定。集成面见 model_access 维那份清单，其中「MCP servers」被官方列进受保护对象面——也就是说它既可作为 MCP 侧的防护，也把 MCP server 当被检对象。具体传输方式与工具审批语义：本批次未逐条核验。
Two API endpoints on record (/guard and /guard/results), with a boolean flagged verdict in the response. The integration surface is the list in the model_access axis, where "MCP servers" appears among the protected objects — meaning it both acts as MCP-side protection and treats MCP servers as objects under inspection. Concrete transports and tool-approval semantics: not verified item by item in this pass.
上下文与记忆Context & memory: 判定按单次文本请求组织，策略按 project 分档（Project mode 决定「block the interaction or logging for investigation」），因此它的「记忆」面就是项目与策略配置，不是跨会话上下文。跨会话记忆或历史串联：官方未说明，记未知。
Verdicts are organised per text request, and policies are tiered per project (Project mode decides between "block the interaction or logging for investigation"), so its "memory" surface is project and policy configuration, not cross-session context. Cross-session memory or history stitching: not stated officially, recorded as unknown.
权限与限制Permissions & limits: 按官方条款逐条读：隐私入口当日 301 到 checkpoint.com/privacy，主体写作「Check Point Software Technologies Ltd.」；留存原文是「We will retain your information for as long as necessary to achieve the purposes described in this Privacy Policy.」；出境原文是「We may collect and transfer Personal Data on a global basis」并说明 EEA/UK 之外的传输依 adequacy 等机制之一；用途原文含「We may use telemetry, threat indicators … including capabilities powered by artificial intelligence (AI)」。⚠ 这些句子说的是个人信息与遥测，没有逐条区分客户 prompt 内容的留存期与训练用途，该项进 unknowns，不做推断。商业档位：pricing 入口当日跳转 platform.lakera.ai/pricing，未渲染出档位正文，报价本站不采。
Read clause by clause from the official terms: the privacy entry 301s to checkpoint.com/privacy, where the entity is written as "Check Point Software Technologies Ltd."; the retention sentence reads "We will retain your information for as long as necessary to achieve the purposes described in this Privacy Policy."; the transfer sentence reads "We may collect and transfer Personal Data on a global basis", with transfers outside the EEA/UK handled via adequacy or one of the other listed mechanisms; the usage sentence includes "We may use telemetry, threat indicators … including capabilities powered by artificial intelligence (AI)". ⚠ Those sentences speak about personal data and telemetry, and do not separately address retention or training use of customer prompt content — that item goes to unknowns, with no inference. Commercial tiers: the pricing entry redirects to platform.lakera.ai/pricing, which did not render tier text when fetched; this site does not collect prices.
适合什么任务Best for: 适合：要在请求链路里实时管住 prompt injection / jailbreak / PII 泄露 / 违规内容，并且接受检测跑在厂商侧；策略要能在「阻断」与「只留档」之间按项目切换；栈里已经有 Bedrock、Copilot Studio、Agentforce、n8n 或 MCP server。不适合：必须离线或私有化部署（未取到该口径）；要换掉/自选底层检测模型；只想自己跑一轮可复现扫描留工程证据（那是 garak 与 PyRIT 的方向）；Red 评估还要联系团队、非自助开通。
Fits: needing live control of prompt injection / jailbreak / PII leakage / violating content inside the request path, accepting that detection runs vendor-side; needing policies that switch per project between blocking and logging only; already running Bedrock, Copilot Studio, Agentforce, n8n or MCP servers. Not a fit: mandatory offline or private deployment (no such statement captured); wanting to swap or choose the underlying detection model; wanting only a reproducible self-run scan for engineering evidence (that is the garak and PyRIT direction); and Red assessments are not self-serve.

头号误解Top misconception

把官网三条产品线当成可自托管组件：当日在册只有托管控制台 + Bearer API
把 Project mode 的「block」读成拦截比例：官方在册的是策略开关，不给任何比例结论
还按 Lakera 旧主体读数据条款：privacy 与 security 入口当日均 301 到 Check Point 侧

证据来源Evidence sources

最近核验记录Latest recorded check 2026-11-06，内容更新日content updated on 2026-11-06。单项复核范围见正文或来源说明，不代表所有字段在同一天重新核验。See the text or source notes for item-specific scope; this does not mean every field was rechecked on that date.

类型Type	名称Name	链接Link
official	Lakera · 官网首页（「The AI-Native Security Platform」、三条产品线、docs 入口与 Check Point 署名；直读 200，2026-11-06）Lakera · official site ("The AI-Native Security Platform", the three product lines, the docs entry and the Check Point credit; direct-fetched 200, 2026-11-06)	https://www.lakera.ai/
official	Lakera · /security 跳转事实（301 → checkpoint.com/ai-security/；当日实测，2026-11-06）Lakera · /security redirect fact (301 → checkpoint.com/ai-security/; measured the same day, 2026-11-06)	https://www.lakera.ai/security
docs	Check Point · AI Security 页（跳转目标在册产品线：Workforce / Application / Agent Runtime Security / AI Red Teaming；直读 200，2026-11-06）Check Point · AI Security page (redirect target with product lines on record: Workforce / Application / Agent Runtime Security / AI Red Teaming; direct-fetched 200, 2026-11-06)	https://www.checkpoint.com/ai-security/
docs	Check Point · Privacy Policy（主体名、留存句、全球传输句、telemetry 与 AI 用途句；直读 200，2026-11-06）Check Point · Privacy Policy (entity name, retention sentence, global-transfer sentence, telemetry-and-AI usage sentence; direct-fetched 200, 2026-11-06)	https://www.checkpoint.com/privacy/
docs	Lakera Docs · Developer quickstart（platform.lakera.ai 注册、LAKERA_GUARD_API_KEY、POST api.lakera.ai/v2/guard 与 messages/project_id；直读 200，2026-11-06）Lakera Docs · Developer quickstart (platform.lakera.ai sign-up, LAKERA_GUARD_API_KEY, POST api.lakera.ai/v2/guard with messages/project_id; direct-fetched 200, 2026-11-06)	https://docs.lakera.ai/docs/quickstart
docs	Lakera Docs · API Reference（/guard 与 /guard/results、Bearer 鉴权、响应含 git_revision 与 model_version；直读 200，2026-11-06）Lakera Docs · API Reference (/guard and /guard/results, Bearer authentication, responses carrying git_revision and model_version; direct-fetched 200, 2026-11-06)	https://docs.lakera.ai/api-reference
docs	Lakera Docs · AI Agent Security / Guard（防护类别、Project mode 的阻断或留档、集成清单含 MCP servers；直读 200，2026-11-06）Lakera Docs · AI Agent Security / Guard (protection categories, Project mode block-or-log, integration list including MCP servers; direct-fetched 200, 2026-11-06)	https://docs.lakera.ai/guard
docs	Lakera Docs · AI Red Teaming（四步评估流程、覆盖的攻击类别、交付物、需联系团队；直读 200，2026-11-06）Lakera Docs · AI Red Teaming (four-step assessment flow, attack categories covered, deliverables, contact-sales requirement; direct-fetched 200, 2026-11-06)	https://docs.lakera.ai/red
changelog	Lakera Docs · Changelog 2026-10-26（Analytics 页给 Guard API 延迟 25/50/75/95 分位图；直读 200，2026-11-06）Lakera Docs · Changelog 2026-10-26 (Guard API latency 25/50/75/95 percentile chart added to Analytics; direct-fetched 200, 2026-11-06)	https://docs.lakera.ai/changelog/2026-10-26
pricing	Lakera · Pricing 入口（301 → platform.lakera.ai/pricing；当日抓取未渲染出档位正文，报价不采，2026-11-06）Lakera · Pricing entry (301 → platform.lakera.ai/pricing; tier text did not render when fetched, prices not collected, 2026-11-06)	https://www.lakera.ai/pricing

官方口径与未核到项Official record and unverified items

本站未做端到端实测：没有发起过 /guard 调用，没有跑过 Red 评估项目，不产出延迟、准确率或任何比例结论，也不做产品排名。本档案只组织官网、跳转事实、Check Point 隐私条款、四个 Docs 页面与 Changelog 在册的说法。 实测建议（四条）：

策略分档的实际语义：Project mode 选「logging」时，你的应用拿到的是什么形态的响应（flagged 字段与后续处置）
响应里 model_version 的可追溯性：能否用于变更审计，官方未说明
客户 prompt 内容的留存期与删除路径（条款未逐条区分，见 unknowns）
私有化/自托管是否存在（当日未取到任何官方口径）

This site has not run it end to end: no /guard call issued, no Red assessment project run, so no latency, accuracy or ratio conclusions and no product rankings. This archive only organises statements on record at the official site, the redirect evidence, Check Point's privacy policy, four docs pages and the changelog.

Suggested measurements (four):

What "logging" actually returns: when Project mode is set to log-only, what shape of response your application receives (the flagged field and downstream handling)
Traceability of model_version in responses: whether it is usable for change audit, which the vendor does not state
Retention and deletion path for customer prompt content (the terms do not separate it; see unknowns)
Whether a private/on-prem form exists (no official statement captured)

变更记录说明

本对象有独立 changelog：docs.lakera.ai/changelog/ 下按日期分条，最新在册条目为 2026-10-26（Analytics 页新增 Guard API 请求延迟的 25/50/75/95 分位图），sitemap 可回溯到 2023-10-05，条目大致两周一条。 这条变化对本档案的意义是运维面而不是防护面：它给的是延迟观测，不是拦截效果指标；本站不把任何此类数值转写成「拦得住多少」。仓库形态为闭源 SaaS，无 releases 可比。

能力边界

能确认的判定类别（官方 Guard 页在册）：prompt attacks / data leakage / content violations，含 jailbreak、PII、攻击性与违规内容，以及「dangerous actions outside the agent's trusted mandate」这类 agent 越权动作。
判定形式是每次请求返回的布尔与分类，不是覆盖率证明；类别名字说明的是测试语义，本站不做比例换算。
检测发生在 Lakera/Check Point 侧，这意味着数据出境与留存是选型的第一道问题——而当日条款文本只覆盖个人信息与遥测， 客户 prompt 内容的留存与训练用途未逐条在册。

部署建议

先解决尽调问题：客户 prompt 是否出境、留存多久、是否进训练——当日条款文本没有逐条回答这三问，要拿 DPA 再判。
灰度时先让 Project mode 走「logging」，把 flagged 的处置权留在自己应用里，再决定何时切「block」。
把响应里的 model_version / git_revision 记进你的变更日志，否则事后无法举证当时用的是哪一版检测。
红队需求先分清：要工程可复现的探针记录走 PyRIT/garak，要一份带整改建议的托管评估再联系 Lakera Red。