Skip to Content
Launching the open-source gateway

Security

The controls that decide what is stored, what personal data reaches a provider, and who can send requests.

The gateway at https://gateway.respan.ai sits between your app and every model provider. That makes it the one place to decide what gets logged, what personal data a provider sees, and which keys may call it. Most controls are set once for the organization or on a key, so your application code doesn’t change.

Controls

ControlWhat it doesWhere you set it
Data retention and ZDRZero data retention agreements, keeping request and response content out of Respan logs with disable_log, and how long logs are kept.Agreement, request, organization, project
API keysScopes each key to a project and environment, with permissions, IP ranges, expiry, and spend limits.API key
Safety identifiersSends your end user’s ID to the provider for abuse tracking, and tags the request in Respan with customer_identifier.Request
PII redactionMasks personal data in chat input before it reaches the provider and the log.Project
Bring your own keyCalls providers with your own provider keys, under your own agreement with each provider.Provider key

How the controls combine

The gateway applies the controls in a fixed order for each request:

  1. The API key is checked: it must exist, be unexpired, hold the Gateway permission, and come from an allowed IP range.
  2. PII redaction runs on a chat request’s input, so the token count for limits is taken on the redacted text. Other endpoints are refused for an organization that redacts.
  3. Limits are checked before any provider call: the key’s RPM, TPM and usage cap, limit policies, customer budgets and rate limits, and your plan’s permissions.
  4. The model resolves to its attempts, and they are tried in turn, your own provider keys first.
  5. The log is written according to your logging settings.

A request refused at any step never reaches a provider and isn’t charged.

Good to know

  • Every call is logged by default. Tokens, cost, latency, and the request and response are saved to your project. Use disable_log to keep content out.
  • Respan’s own parameters never reach the provider. Fields such as customer_identifier, metadata, and disable_log are read by the gateway and removed before the request is sent.
  • A custom api_base must resolve to a public address. The gateway refuses a provider base URL that points at a private network.
  • Call the gateway from your server. The gateway answers no browser preflight unless your origin is allowed, and a key in client-side code can be copied.

Next steps