Inspected at every hop — in, and out.
A deterministic path every agent request takes — five stages, one service, entirely inside your network. Fail-open on infrastructure, sub-second added latency.
Identify
Auth, rate & budget.
Inspect
Regex, DLP, forensic scan.
Route
Provider & failover.
Restore
De-tokenize, egress scan.
Record
Crypto audit → store.
Who is asking, and can they?
Every request is authenticated, rate-limited, and budget-checked at the door — before a single token is spent. Identity flows through to per-agent policy and the audit record.
- API-key, mTLS, or SSO-backed agent identity
- Per-tenant and per-agent rate & budget enforcement
- Cedar-style policy evaluation in the hot path
The six surfaces, in real time.
Layered inspection runs across prompt, RAG, tool, session, and agent-to-agent traffic. Regex and DLP catch the obvious; a forensic SLM catches what they miss; self-healing scrutiny raises the bar when an agent looks hostile.
- Regex → DLP → forensic-SLM, layered
- PHI / PCI / IP / HR detection engines
- NORMAL → ELEVATED → STRICT, automatically
To the right model, every time.
Once a request clears inspection, TrustGate routes it to the chosen provider with automatic failover — OpenAI, Anthropic, Bedrock, Azure, or your self-hosted models — behind one OpenAI-compatible endpoint.
- Multi-provider with health-aware failover
- Drop-in OpenAI-compatible — no app changes
- Self-hosted & GPU model targets supported
Clean on the way out, too.
The response is de-tokenized to restore real values, scanned for PII leakage and exfiltration, and run through egress forensics — so what leaves the model is as governed as what entered it.
- Reversible PII tokenization restored in-response
- Output scan for leakage & data exfiltration
- Egress forensics on every response
A trail you can actually prove.
Every request is written to a cryptographically chained, tamper-evident audit trace — then streamed and stored where you choose. Evidence your auditors and procurement team can verify, not just trust.
- Cryptographically chained audit records
- Stream to SIEM · store in your own bucket
- Export-ready evidence per framework
Built to sit in the hot path.
One service in your VPC, designed so security never takes your agents offline.
See the pipeline on your own traffic.
Deploy the open core in three commands, or book a walkthrough with our team.