Skip to main content
At Fireworks, protecting customer data is at the core of our platform. We design all of our systems, infrastructure, and business processes to ensure customer trust through verifiable security & compliance. This page provides an overview of our key security measures. For documentation and audit reports, see our Trust Center.

​
Zero Data Retention

Fireworks does not log or store prompt or generation data for open models, without explicit user opt-in. See our Zero Data Retention Policy.

​
Secure Data Handling

Data Ownership & Control: Customers maintain ownership of their data. Customer data stored as part of an active workflow can be permanently deleted with auditable confirmation, and secure wipe processes ensure deleted assets cannot be reconstructed. Encryption: Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Bring Your Own Bucket: Customers may integrate their own cloud storage to retain governance and apply their own compliance frameworks. Access Logging: All customer data access is logged, monitored, and protected against tampering. See Audit & Access Logs.

​
Workload Isolation

Dedicated workloads run in logically isolated environments, preventing cross-customer access or data leakage.

​
Secure Training

Fireworks enables secure model training, including fine-tuning and reinforcement learning, while maintaining customer control over sensitive components and data. This approach builds on our Zero Data Retention policy to ensure sensitive training data never persists on our platform. Customer-Controlled Architecture: For advanced training workflows like reinforcement learning, critical components remain under customer control:
  • Reward models and reward functions are kept proprietary and not shared
  • Rollout servers and training metrics are built and managed by customers
  • Model checkpoints are managed through secure cloud storage registries
Minimal Data Sharing: Training data is shared via controlled bucket access with minimal sharing and step-wise retention, limiting data exposure while enabling effective training workflows. API-Based Integration: Customers leverage Fireworks’ training APIs while maintaining full control over sensitive components, ensuring no cross-component data leakage.

​
Secure reinforcement fine-tuning (RFT)

Use reinforcement fine-tuning while keeping sensitive components and data under your control. Follow these steps to run secure RFT end to end using your own storage and reward pipeline.
1

Configure storage (BYOB)

Point Fireworks to your storage so you retain governance and apply your own compliance controls.
Grant least-privilege IAM to only the bucket/path prefixes needed for training. Use server-side encryption and your KMS policies where required.
2

Prepare your reward pipeline and rollouts

Keep your reward functions, rollout servers, and training metrics under your control. Generate rewards from your environment and write them to examples in your dataset (or export a dataset that contains per-example rewards).
  • Reward functions and reward models remain proprietary and never need to be shared
  • Rollouts and evaluation infrastructure run in your environment
  • Model checkpoints can be registered to your storage registry if desired
3

Create a dataset that includes rewards

Create or point a Dataset at your BYOB storage. Ensure each example contains the information required by your reward pipeline (for example, prompts, outputs/trajectories, and numeric rewards).
You can reuse existing supervised data by attaching reward signals produced by your pipeline, or export a fresh dataset into your bucket for consumption by RFT.
4

Run reinforcement step from Python

Use the Python SDK to run reinforcement steps that read from your BYOB dataset and produce a new checkpoint.
# Assumes you have an authenticated `llm` client and a `dataset` that
# references your BYOB bucket with per-example rewards.
import time

job = llm.reinforcement_step(
    dataset=dataset,                 # Dataset with rewards in your bucket
    output_model="my-improved-model-v1",  # New checkpoint name (must not exist)
    epochs=1,
    learning_rate=1e-5,
    accelerator_count=2,
    accelerator_type="NVIDIA_H100_80GB",
)

# Wait for completion
while not job.is_completed:
    job.raise_if_bad_state()
    time.sleep(1)
    job = job.get()
    if job is None:
        raise RuntimeError("Job was deleted while waiting for completion")

# The new model is now available at job.output_model
See LLM.reinforcement_step() and ReinforcementStep for full parameters and return types.
When continuing from a LoRA checkpoint, training parameters such as lora_rank, learning_rate, max_context_length, epochs, and batch_size must match the original LoRA training.
5

Verify outputs and enforce controls

  • Validate the new checkpoint functions as expected in your environment
  • If exporting models to your storage, apply your registry policies and access reviews
  • Review audit logs and rotate any temporary credentials used for the run
Do not store long-lived credentials in code. Use short-lived tokens, workload identity, or scoped service accounts when granting Fireworks access to your buckets.
You now have an end-to-end secure RFT workflow with BYOB datasets, proprietary reward pipelines, and isolated training jobs that generate new checkpoints.

​
Technical Safeguards

  • Device Trust: Only approved, secured devices with strong authentication can access sensitive Fireworks systems.
  • Identity & Access Management: Fine-grained access controls are enforced across all Fireworks environments, following the principle of least privilege.
  • Network Security
    • Private network isolation for customer workloads.
    • Firewalls and security groups prevent unauthorized inbound/outbound traffic.
    • DDoS protection is in place across core services.
  • Monitoring & Detection: Real-time monitoring and anomaly detection systems alert on suspicious activity
  • Vulnerability Management: Continuous scanning and patching processes keep infrastructure up to date against known threats.

​
Operational Security

  • Security Reviews & Testing: Regular penetration testing validates controls.
  • Incident Response: A formal incident response plan ensures swift containment, customer notification, and remediation if an issue arises.
  • Employee Access: Only a minimal subset of Fireworks personnel have access to production systems, and all access is logged and periodically reviewed.
  • Third-Party Risk Management: Vendors and subprocessors undergo rigorous due diligence and contractual security obligations.

​
Compliance & Certifications

Fireworks aligns with leading industry standards to support customer compliance obligations:
  • SOC 2 Type II (certified)
  • ISO 27001 / ISO 27701 / ISO 42001 (in progress)
  • HIPAA Support: Firework is HIPAA compliant and supports healthcare and life sciences organizations in leveraging our rapid inference capabilities with confidence.
  • Regulatory Alignment: Controls are mapped to GDPR, CCPA, and other international data protection frameworks
Documentation and audit reports are available in our Trust Center.
⌘I