AI Integrations

Bring your own AI provider key for AI Smart Triage. Anthropic, OpenAI, Gemini, or self-hosted models. The bundled Gemini fallback works out of the box.

What AI is used for

Sectora uses AI in two places:

  • AI Smart Triage — reviews each scan finding to mark likely false positives + cite reasoning + generate fix suggestions. Most active use.
  • Supply-chain LLM detector (Pro tier) — analyzes published artifacts for malicious-release patterns.
  • (Coming soon) Auto-Fix — generates a PR with the fix.

Providers supported

Anthropic (Claude)
OpenAI (GPT-4o + above)
Google Gemini
Cohere
Self-hosted via Ollama
Self-hosted via vLLM / TGI
Azure OpenAI
AWS Bedrock

Default — bundled Gemini fallback

Set your own key when:

  • You're hitting the daily cap on a large scan workload
  • You want a specific model (e.g. Claude Sonnet 4 for higher-quality verdicts)
  • Your security policy requires AI providers to be on YOUR account, not ours
  • You're self-hosting (air-gapped environments)

Setup

Settings → Integrations → AI Providers → + Add provider. For Anthropic / OpenAI / Gemini, paste your API key. For self-hosted, provide the inference endpoint URL.

# Self-hosted Ollama example
endpoint: https://ollama.your-vpc.internal/v1
model: llama3.1:70b-instruct
api_key: (optional bearer if your inference gateway requires)

Key handling

Provider keys are AES-256 encrypted at rest using the org's envelope key. Decrypted only at inference time. Sectora never logs the key value; only the last 4 chars appear in audit logs.

Model selection

Different tasks have different requirements. Configure per-task:

Smart Triage:
  recommended: Claude Sonnet 4 / GPT-4o
  budget:      Gemini 1.5 Flash / Claude Haiku

Supply-chain LLM detector:
  recommended: Claude Opus 4 (high reasoning)
  budget:      Gemini 1.5 Pro

Auto-Fix (coming):
  recommended: Claude Sonnet 4 (best code completion)
  budget:      GPT-4o

Cost monitoring

Settings → AI Providers → Usage shows daily token + dollar usage per provider, with breakdowns by task. Set per-day caps to prevent surprise bills.

Fallback chain

Configure multiple providers in priority order. If the primary fails (rate limit, outage, key expired), Sectora falls through to the next. The bundled Gemini fallback is always at the bottom of the chain unless explicitly disabled.

Privacy

When using your own provider key, your scan data + code snippets go to that provider — same as if you'd called the API directly. Provider data-handling policies apply (Anthropic + OpenAI + Gemini all offer no-training options on their API plans).

For air-gapped environments, use a self-hosted Ollama / vLLM endpoint. Data never leaves your VPC.

What's next