Security & trust
A gateway sees your traffic, so it owes you precision about what it does - and refuses to do - with it. This page is the plain-language version; the privacy policy is the formal one.
Data handling
What we see, what we keep
- No training on your data, ever. Pure routing is the product. We don't train models, we don't sell data, and providers receive your request under their API terms, not ours.
- No prompt retention by the gateway. Request and response bodies transit; the ledger stores metadata - model, token counts, latency, exact cost, trace ID - not content.
- Private models never leave your network. Device-agent inference happens inside your VPC over an outbound-only mTLS tunnel; only routing metadata reaches the control plane.
- Caches are tenant-scoped. Exact-match and semantic caches are per-organization. There is no cross-tenant cache.
- Hosted in Canada. Control plane and ledger live in Montréal, designed for Canadian privacy law and the GDPR, with enterprise residency options.
Infrastructure
How the gateway protects itself
- Encryption everywhere: TLS 1.3 in transit, AES-256 at rest for the ledger and configuration, mTLS with pinned per-agent identities for model-tunnel tunnels.
- Least-privilege keys: keys are assigned to named users, scoped by model locks and budgets, and revocable individually - including each agent's tunnel identity.
- Blast-radius design: burnable prepaid keys fence spend before it happens; the kill switch bounds runaway behavior in minutes, not billing cycles.
- Audit trail: every call, budget change, lock change and breaker trip is an exportable ledger event.
Key-level controls
Every API key is a policy
Security that lives on the key travels with the key - into CI, onto a contractor's laptop, inside a student's badge. All of these are set at creation or updated live via the keys API.
- Burnable prepaid balance (
prepaid_usd): the key is the budget; it stops at zero and can never surprise an invoice. - Bound to a person (
user_email): every call lands on the ledger under a name, and offboarding is one revoke. - Model restrictions (
allowed_models): a lock list; anything else returns403 model_locked. - IP / CIDR allowlists and country restrictions: pin a key to your VPC's egress range or to
["CA","FR"], enforced at the edge before any model is touched. - PII redaction: mask replaces detected emails, phone numbers, card numbers and government IDs with typed placeholders before the request leaves for a provider; block refuses the request outright with
422 pii_detected. Per-request overrides may only be stricter. - Expiry (
expires_at): keys that self-revoke when the contract, the semester or the demo ends. - Cache savings policy (
sg_cache_default): turn exact-match or semantic caching on per key; hits bill exactly 0 credits and are tagged on the ledger. - Rate limits & concurrency per key (
rate_limit_rpm,max_concurrency): spend caps bound the damage in dollars, not in requests - a leaked key capped at $50 can still hammer you 10,000 times a minute. Cap both. - Kill switch thresholds: per-key velocity limits for the runaway-agent breaker, tunable but never removable on prepaid keys.
Availability by plan is on the comparison board - IP allowlists from Pro, country pinning and PII redaction from Team.
Responsible disclosure
Found something? Tell us first.
Report vulnerabilities to [email protected] with steps to reproduce. We acknowledge within one business day, keep you updated through the fix, credit researchers who want credit, and never pursue good-faith research. Please avoid accessing other customers' data and give us reasonable time before publishing. Machine-readable details live at /.well-known/security.txt.
Security questions before you route production traffic?
Bring your questionnaire. We answer them for a living now.