AISG is a vendor-neutral AI governance layer that sits between your application and any LLM provider. It scans every request for sensitive data and attacks — and redacts or blocks them before anything reaches the model. Self-hosted via Docker, OpenAI SDK compatible, Apache 2.0.

Your LLM provider should never see your users' emails, SSNs, or API keys. AISG makes sure it doesn't.

Prefer zero setup? Try the managed cloud version free → aisecuritygateway.ai — 1M credits, no credit card required.

• PII redaction — emails, phone numbers, credit cards, SSNs, names, locations, IP addresses
• Secret detection — API keys, AWS credentials, GitHub tokens, private keys
• Prompt injection blocking — detects jailbreak and instruction override attempts
• OpenAI SDK compatible — drop-in replacement, change one line of code
• Multi-provider routing — 8 providers out of the box: OpenAI, Anthropic, Groq, Together, Gemini, Mistral, DeepInfra, xAI — BYOK, swap in config
• Fail-closed by default — if the safety layer is down, requests are blocked, never forwarded unscanned
• Zero cloud dependencies — runs entirely on your machine via Docker
• No telemetry — zero external calls, no analytics, no phone-home
• SAML SSO — Okta, Azure AD, Google Workspace, and any SAML 2.0 IdP (cloud)
• RBAC — 4-tier role hierarchy (Owner/Admin/Member/Viewer) with 17 granular permissions (cloud)
• SIEM connectors — stream security events to Splunk HEC, Datadog Logs, or Microsoft Sentinel (cloud)
• Hybrid VPC deployment — compiled Go proxy in your network, prompts never leave your VPC (cloud)

Your App  ──▸  AISG Gateway  ──▸  Presidio (PII scan)  ──▸  LLM Provider
                    │                                            │
                    │◂── redacted or blocked ──────────────────▸│
                    │◂── clean response ────────────────────────│

☁️ Want it managed? Skip Docker entirely → aisecuritygateway.ai — 1M free credits, no credit card, 600+ models, smart routing, SAML SSO, RBAC, SIEM connectors, Hybrid VPC, and EU AI Act compliance logging.

Prerequisites: Docker and Docker Compose.

git clone https://github.com/aisecuritygateway/aisecuritygateway.git
cd aisecuritygateway

1. Configure

cp .env.example .env

Edit .env and add at least one provider key (any provider with a key is available):

GROQ_API_KEY=gsk_your_key_here
OPENAI_API_KEY=sk-your_key_here
ANTHROPIC_API_KEY=sk-ant-your_key_here
TOGETHER_API_KEY=your_key_here
GEMINI_API_KEY=your_key_here
MISTRAL_API_KEY=your_key_here
DEEPINFRA_API_KEY=your_key_here
XAI_API_KEY=your_key_here
AISG_API_KEY=change-me-to-a-real-secret

You only need one provider key to get started — the gateway routes to any provider with a configured key.

2. Start

docker compose up --build

First build pulls the spaCy language model (~500 MB) and takes 2–3 minutes. Subsequent starts are fast. The gateway waits for Presidio to be healthy before accepting requests.

3. Send a request

curl http://localhost:8000/v1/chat/completions \
  -H "Authorization: Bearer change-me-to-a-real-secret" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "llama-3.3-70b-versatile",
    "messages": [
      {"role": "user", "content": "Summarize this: my email is alice@acme.com and SSN is 123-45-6789"}
    ]
  }'

The gateway redacts the email and SSN before forwarding to the LLM. The response includes aisg_metadata.pii_detected: true and details about what was found.

4. Use with the OpenAI SDK (Python)

from openai import OpenAI

client = OpenAI(
    base_url="http://localhost:8000/v1",
    api_key="change-me-to-a-real-secret",
)

response = client.chat.completions.create(
    model="llama-3.3-70b-versatile",
    messages=[{"role": "user", "content": "My SSN is 123-45-6789. What is machine learning?"}],
)
print(response.choices[0].message.content)
# The LLM never saw the SSN — it was redacted before forwarding.

5. Or use the AISG Python SDK

pip install aisg

from aisg import AISG

client = AISG(api_key="your-gateway-key", base_url="http://localhost:8000/v1")

response = client.chat.create(
    model="llama-3.3-70b-versatile",
    messages=[{"role": "user", "content": "My SSN is 123-45-6789"}],
)
print(response.aisg_metadata.pii_detected)        # True
print(response.aisg_metadata.entity_types_detected) # ["US_SSN"]

The SDK adds typed responses, structured error handling (DLPBlockError, BudgetExhaustedError, LoopDetectedError), async support, and model discovery. Works with both self-hosted and managed cloud deployments. → Full SDK docs

Skip the setup? The managed version at aisecuritygateway.ai gives you everything here plus dashboards, SAML SSO, RBAC, SIEM connectors, Hybrid VPC deployment, smart cost routing, semantic caching, EU AI Act compliance logging, and recursive loop protection — no Docker required. 1M free credits, no credit card.

                           ┌─────────────────────────────┐
                           │        AISG Gateway          │
    ┌──────────┐           │                              │           ┌──────────────┐
    │          │  POST     │  1. Auth (API key)           │           │              │
    │ Your App ├──────────▸│  2. Resolve provider/model   │──────────▸│ LLM Provider │
    │          │           │  3. DLP scan (Presidio)      │           │  (8 supported)│
    │          │◂──────────│  4. Block or redact           │◂──────────│              │
    └──────────┘  response │  5. Forward to upstream      │  response └──────────────┘
                           │  6. Return with metadata     │
                           │                              │
                           │         ┌──────────┐         │
                           │         │ Presidio │         │
                           │         │ (PII/NER)│         │
                           │         └──────────┘         │
                           └─────────────────────────────┘

1. Auth — validate the Bearer token against gateway.yaml API keys
2. Provider resolution — pick provider and model from headers or defaults
3. DLP scan — send message text to Presidio for entity detection
4. Enforce policy — redact replaces PII with [REDACTED]; block rejects the request. Prompt injection attempts are always blocked.
5. Forward — cleaned request is sent to the upstream LLM via LiteLLM
6. Response — original provider response + gateway metadata headers

All config lives in three files:

providers:
  groq:
    api_key: "${GROQ_API_KEY:-}"
  openai:
    api_key: "${OPENAI_API_KEY:-}"
  anthropic:
    api_key: "${ANTHROPIC_API_KEY:-}"
  together:
    api_key: "${TOGETHER_API_KEY:-}"
  gemini:
    api_key: "${GEMINI_API_KEY:-}"
  mistral:
    api_key: "${MISTRAL_API_KEY:-}"
  deepinfra:
    api_key: "${DEEPINFRA_API_KEY:-}"
  xai:
    api_key: "${XAI_API_KEY:-}"

api_keys:
  - key: "${AISG_API_KEY:-dev-key-change-me}"
    name: "default"

dlp:
  action: redact                # "redact" or "block"
  confidence_threshold: 0.4
  entities:
    - EMAIL_ADDRESS
    - PHONE_NUMBER
    - CREDIT_CARD
    - US_SSN
    - PERSON
    - LOCATION
    - IP_ADDRESS
    - API_KEY
    - AWS_ACCESS_KEY
    - PRIVATE_KEY
    - GITHUB_TOKEN
    - SLACK_WEBHOOK
    - PROMPT_INJECTION

Environment variables are resolved with ${VAR} or ${VAR:-default} syntax.

Defines which LLM providers are available and their LiteLLM mapping:

{
  "providers": {
    "groq": { "litellm_prefix": "groq", "default_model": "llama-3.3-70b-versatile", "enabled": true },
    "openai": { "litellm_prefix": "openai", "default_model": "gpt-4.1-mini", "enabled": true },
    "anthropic": { "litellm_prefix": "anthropic", "default_model": "claude-sonnet-4-6-20260217", "enabled": true },
    "together": { "litellm_prefix": "together_ai", "default_model": "meta-llama/Llama-3.3-70B-Instruct-Turbo", "enabled": true },
    "gemini": { "litellm_prefix": "gemini", "default_model": "gemini-2.5-flash", "enabled": true },
    "mistral": { "litellm_prefix": "mistral", "default_model": "mistral-large-latest", "enabled": true },
    "deepinfra": { "litellm_prefix": "deepinfra", "default_model": "meta-llama/Llama-3.3-70B-Instruct", "enabled": true },
    "xai": { "litellm_prefix": "xai", "default_model": "grok-3-mini", "enabled": true }
  }
}

Runtime environment variables referenced by gateway.yaml:

GATEWAY_PORT=8000
LOG_LEVEL=info
PRESIDIO_WORKERS=1

# Add any provider keys you have — leave blank to skip
GROQ_API_KEY=gsk_...
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...
TOGETHER_API_KEY=...
GEMINI_API_KEY=...
MISTRAL_API_KEY=...
DEEPINFRA_API_KEY=...
XAI_API_KEY=...

AISG_API_KEY=your-secret-key

Full machine-readable specs:

• OpenAPI 3.1 Spec — import into any API tool or Swagger UI
• Postman Collection — ready-to-run requests (Postman v2.1)

Discover available models programmatically. Returns live data — disabled providers and retired models are excluded in real-time.

curl http://localhost:8000/v1/models \
  -H "Authorization: Bearer your-api-key"

# Filter by family, capability, or provider
curl "http://localhost:8000/v1/models?family=llama" \
  -H "Authorization: Bearer your-api-key"

curl "http://localhost:8000/v1/models?capability=vision" \
  -H "Authorization: Bearer your-api-key"

Query parameters:

Response:

{
  "object": "list",
  "data": [
    {
      "id": "oah/llama-3.3-70b-versatile",
      "object": "model",
      "owned_by": "ai-security-gateway",
      "family": "llama",
      "supports_vision": false,
      "supports_tools": true,
      "context_window": 131072,
      "providers": ["together", "deepinfra"],
      "pricing": { "input_per_1m_tokens": 0.59, "output_per_1m_tokens": 0.79 }
    }
  ]
}

OpenAI-compatible chat completions endpoint.

Headers:

Request body: Standard OpenAI chat completion format.

Response: Standard OpenAI response + aisg_metadata object:

{
  "aisg_metadata": {
    "provider_selected": "groq",
    "latency_ms": 12,
    "dlp_latency_ms": 8,
    "pii_detected": true,
    "dlp_action": "redact",
    "violations_count": 2,
    "entity_types_detected": ["EMAIL_ADDRESS", "US_SSN"]
  }
}

Returns gateway health status and Presidio connectivity.

aisecuritygateway/
├── docker-compose.yml          # Orchestrates gateway + presidio
├── .env.example                # Environment variables template
├── config/
│   ├── gateway.yaml            # Provider keys, API auth, DLP policy
│   └── providers.json          # LLM provider registry
├── proxy-api/                  # The gateway service
│   ├── Dockerfile
│   ├── requirements.txt
│   └── app/
│       ├── main.py             # FastAPI app + middleware
│       ├── config.py           # Settings + gateway.yaml loader
│       ├── auth.py             # API key authentication
│       ├── dlp.py              # Presidio client + DLP enforcement
│       ├── providers.py        # LiteLLM provider routing
│       ├── models.py           # Pydantic request/response models
│       ├── log_utils.py        # Structured logging + secret scrubbing
│       └── routers/
│           ├── proxy.py        # POST /v1/chat/completions
│           └── health.py       # GET /health
└── presidio/                   # PII detection service
    ├── Dockerfile
    ├── requirements.txt
    ├── recognizers.yaml         # Custom recognizer definitions
    └── app/
        ├── main.py             # FastAPI app + /process endpoint
        ├── models.py           # Pydantic models
        ├── recognizers.py      # Custom recognizer implementations
        └── post_processor.py   # False-positive filtering

• FAIL-CLOSED BY DEFAULT — if Presidio is unreachable, requests are blocked, never forwarded unscanned. Most competing proxies fail-open for convenience. AISG treats an unreachable safety layer as a hard stop.
• Auth by default — API key authentication is enabled out of the box
• No telemetry — zero external calls, no analytics, no phone-home
• Secret scrubbing — structured logs automatically mask API keys and tokens
• Rate limiting — token bucket per API key (default 10 req/sec)
• CORS — defaults to * for local development; restrict CORS_ORIGINS to your domain(s) and place behind a reverse proxy (e.g. Nginx, Caddy) in production

OSS (self-hosted): Route to any of 8 providers using the x-provider and x-model headers — OpenAI, Anthropic, Groq, Together, Gemini, Mistral, DeepInfra, and xAI. You pick the provider and model, the gateway forwards using your own keys via LiteLLM. Add a provider key, and it's available immediately.

Cloud (managed): Full Smart Router with real-time cost optimization, dynamic provider selection (cheapest + fastest for each request), automatic failover chains, live pricing registry, and per-project budget policies. No manual configuration needed.

This split keeps the OSS powerful and transparent while reserving the intelligent, production-grade routing engine for teams that want zero ops and maximum cost savings.

This repo gives you the core AI security proxy. The managed AI Security Gateway Cloud adds everything you need to run it across teams at scale.

Try the managed cloud free → — 1M free credits, no credit card required. Includes SSO, RBAC, SIEM, and Hybrid VPC.

Three features — loop protection, EU AI Act logging, and semantic caching — are available only in the managed cloud. This isn't an artificial paywall. Each one requires distributed infrastructure that a single self-hosted instance can't provide correctly:

Enterprise features — SAML SSO, RBAC, and SIEM connectors — are cloud-only because they require a centralized identity store, organization-level metadata, and persistent event streaming infrastructure. SSO requires a dedicated SAML service provider and connection metadata storage. RBAC needs a shared permission model across the organization. SIEM connectors need reliable, authenticated event delivery with retry logic and secret management. These are inherently multi-tenant, stateful services.

Hybrid VPC bridges the gap: a compiled Go proxy runs inside your VPC so prompts never leave your network, while the cloud dashboard manages SSO, RBAC, policies, and analytics via metadata-only telemetry. Deploy via Docker Compose or Kubernetes.

The OSS version — PII redaction, prompt injection blocking, secret detection, fail-closed architecture, 8-provider routing — is a complete, production-ready security proxy. You can self-host it and get real value without the cloud. The cloud adds the operational features that production teams with compliance, reliability, and scale requirements need.

We're committed to growing the OSS over time. The 8-provider expansion (up from 2 at launch) is one example — if a feature doesn't require distributed infrastructure, it belongs in the OSS.

We welcome contributions. See CONTRIBUTING.md for guidelines.

Found a vulnerability? Please read SECURITY.md for responsible disclosure instructions. Do not open a public issue.

Apache 2.0 — Copyright 2026 Datum Fuse LLC

• Website: aisecuritygateway.ai
• Docs: aisecuritygateway.ai/docs
• Crunchbase: crunchbase.com/organization/ai-security-gateway
• LinkedIn: linkedin.com/company/ai-security-gateway
• X / Twitter: @AISGateway
• SAML SSO Docs: aisecuritygateway.ai/docs/saml-sso-authentication
• RBAC Docs: aisecuritygateway.ai/docs/rbac-team-management
• SIEM Docs: aisecuritygateway.ai/docs/siem-connectors
• Hybrid VPC Docs: aisecuritygateway.ai/docs/hybrid-vpc-deployment
• Status: status.aisecuritygateway.ai

Built by Datum Fuse LLC — making AI safe by default.