Hi Promptfoo team, I’m exploring using Promptfoo in the company’s project, and I’d love to understand a bit more about how provider configuration works under the hood. Would you be able to share a simple sketch or diagram of the flow to explain behind the scene(e.g., from developer → Promptfoo config → provider request → response handling) for my security review before applying it? I’m especially curious about a few points: 1. How and where provider configuration (API keys, credentials, endpoints) is stored and loaded. 2. Whether any of that configuration data is ever sent outside the local environment. 3. How Promptfoo keeps providers isolated when multiple are configured. Whether sensitive values are cached, logged, or persisted in any way. And if you happen to have any security-related documentation or notes already prepared, I’d be really grateful if you could share those as well — it would help me explain things clearly to our security team when I pass this along for review. Thanks so much for your help!

@pgduc1511 Heyo! We have some of this information already although it's usually communicated through the enterprise-scheduled calls, especially as there are often other questions specific to a company's use case. I'm checking with the team and will get back to you shortly.

Hi Gia, are you using Promptfoo for LLM evaluations or are you using it for red teaming? Can give you details accordingly. Also, you may find our trust center useful: https://trust.promptfoo.dev/

Hi @Tabs [Promptfoo] @ian , I'm using Promptfooo for LLM evaluation and testing. I just wanna ask how things works behind the scene, escpecially the HTTP provider and evaluation stuff, would be great if you can describe in a simple diagram, for my IT security company team review before applying it 😅 btw I'm a teammate of Kenneth McNelly, the guy who had a call with the co-founder of Promptfoo about the Enterprise version recently. Thanks a lot.

ahh cool. open-source evaluations are run completely locally. that means: 1. Provider and API configuration is stored on the developer machine 2. This configuration data never leaves the local environment 3. When multiple providers are configured, all configurations remain local 4. Promptfoo caches provider responses by default. The cache is local. You can disable this behavior using the

--no-cache

flag The only exception to the above would be if the user intentionally uses the

share

functionality and/or logs into the Promptfoo Cloud. In this case, then results and in some cases configuration settings get pushed to the remote server. By default, this is our hosted cloud, however, it is possible self-host this in the Enterprise version so nothing leaves your environment.

Ok, I got it. Thanks a lot for the explanation @ian