Security that says what exists today.

No badge wall. Here is what Gateway does now, and what is still being built.

Live

Keys stored as hashes

Gateway keys are shown once. Only a SHA-256 hash is stored, with the last four characters for identification.

Provider keys stay server-side

Your applications never hold the model provider key.

Per-organization isolation

Every query is scoped to your organization, and tested for cross-tenant access.

Sensitive data checks

Cards, IBANs, PESEL, emails and common secrets are found in every message. Flag them, mask them before they reach the provider, or block the call. Matched text is never stored; only what kind was found.

Prompt-injection heuristics

Known attack phrases are flagged or blocked. This is a heuristic: it misses some attacks and can flag harmless text, so it starts in monitor mode.

Model policy

Allow only the models you approve. Monitor mode shows what would be blocked; enforce mode rejects the call before it reaches a provider.

Audit log without prompts

We log the decision, model, tokens, latency, and a hash of the prompt, not the prompt itself.

Coming

○ Detection beyond patterns: machine-learning models and custom rules
○ More policy rules, such as spend limits and per-key rules
○ SIEM export for Splunk, Sentinel, and Elastic