Where are the logs?
On-Premises
Your infrastructure, your data, your control
Deploy Lokion's enterprise layer in your own environment. All events stay in your database, exportable to your SIEM on your terms.
On-Prem Architecture
Lokion Products
PromptCloak • MessagingCloak • FileCloak
↓
On-Prem Server
Your infrastructure
↓
Your DB
Your SIEM
Why on-premises matters
Regulated customers need clear answers to critical questions
Who owns the database?
You do – complete data sovereignty
How do events reach our SIEM?
Via your own export schedule and API
Can we store locally?
Yes, everything stays in your infrastructure
On-Prem server capabilities
✓Local event ingestion from all Lokion products
✓Customer-owned database
✓Health monitoring API
✓Event query API
✓SIEM export API with filtering
✓CEF format support
✓Time-based event filtering
✓Product and outcome filtering
SIEM-ready event format
Structured security events ready for your SIEM platform
Timestamp
Product (PromptCloak/MessagingCloak/FileCloak)
Organization ID
User ID or Actor
Action
Outcome (allow/block/anonymize)
Site/Host/Surface
Detection Count
Detection Types
Transform Mode
Replaced Count
Policy Mode
Event Kind
Optional Masked Preview
Optional Full Content (policy-dependent)
Unified event collection
One on-prem server for all Lokion products
PromptCloak
AI prompt events and detections
MessagingCloak
Message control events (planned)
FileCloak
Document analysis events (planned)
Deployment options
Docker Container
Deploy as containerized service in your infrastructure
Recommended for most deploymentsVM Image
Pre-configured virtual machine for quick setup
Available on request