Security Whitepaper

gtwy is a managed gateway that routes, monitors, and secures API calls between your application and multiple AI model providers — giving teams a single point of control over their AI infrastructure. Security is built into how gtwy is designed, shipped, and operated, not treated as a checkbox after the fact.

01. Company & Compliance Overview

gtwy holds SOC 2 Type II certification (an independent audit of security, availability, and confidentiality controls) and ISO 27001 certification (an information security management system covering infrastructure, access control, and incident response), and maintains GDPR and CCPA compliance through the terms set out in its Data Processing Addendum. Full audit reports and certificates are available on request — see the Trust Center.

02. Infrastructure & Architecture

The platform is organized into distinct layers:

• Client layer — your application's API calls into gtwy.
• Gateway layer (gtwy-node) — authentication, org-scoped access control, and rate limiting.
• Model routing layer (gtwy-ai) — per-provider request handling and auto-routing via NotDiamond.
• AI providers — OpenAI, Anthropic, Google, Groq, Mistral, Deepgram.
• Data layer — MongoDB, PostgreSQL/TimescaleDB, Redis, Cloud Storage.

Infrastructure is self-hosted on Google Cloud Platform, located in India.

03. Data Security

Three categories of sensitive data are processed:

• Authentication credentials and provider API keys.
• AI prompts, completions, and conversation history.
• User and organization account metadata.

API keys and other designated secret fields are encrypted at the application layer (AES) before being written to the database. Soft-deleted records are automatically purged 30 days after deletion via MongoDB TTL indexes.

04. Access Control

Access is org-scoped: every request is checked against the authenticated user's organization membership before it can act on that organization's resources. Login uses a third-party authentication proxy rather than a self-managed credential store.

05. Application Security

Secrets are loaded exclusively from environment configuration across all services; .env files are excluded from version control in every repository. Pre-commit checks enforce linting, formatting, and commit-message conventions before code is committed.

06. Network & Infrastructure Security

Both backend services enforce Redis-backed rate limiting on incoming requests (fixed-window, per-key), returning standard Retry-After / X-RateLimit-* headers and an HTTP 429 response once a limit is exceeded.

07. AI & Model Data Handling

Integrated providers, and what gtwy uses each for:

• OpenAI — chat completion, embeddings, image generation.
• Anthropic — chat completion & batch inference.
• Google Gemini — chat completion & multimodal inference.
• Groq — low-latency inference routing.
• Mistral AI — chat completion.
• Deepgram — speech-to-text transcription.
• NotDiamond — automatic model routing across providers.

Full detail on retention, training use, and per-provider handling is in the AI & Model Data Usage Policy.

08. Subprocessors

Summarized by category — the full, current list lives on the Trust Center:

• AI providers: OpenAI, Anthropic, Google, Groq, Mistral, Deepgram, NotDiamond.
• Data stores: MongoDB, PostgreSQL/TimescaleDB, Redis.
• Infrastructure: Google Cloud Platform, RabbitMQ.
• Analytics & ops: PostHog, RTLayer, Cal.com.

09. Incident Response

gtwy maintains an internal process for identifying, escalating, and responding to security incidents. Detailed documentation is available on request.

10. Business Continuity & Disaster Recovery

The platform includes routine backups and recovery processes. Detailed planning documentation is available on request.

11. Employee & Physical Security

Physical security is inherited from Google Cloud Platform's own facility certifications; gtwy's infrastructure is hosted in India. Employee practices, including background checks and training, are documented separately.

12. Contact

Security contact: [email protected]

Last updated 2026-09-01.