1. Our Commitment
At GateConsole, security is a foundational principle. We design, build, and operate our platform with a strong focus on protecting your data, ensuring system reliability, and maintaining compliance with industry standards.
2. Key Security Principles
Secure by Default
Security is built into
every layer of our platform.
Least Privilege Access
Access is granted based
on roles and responsibilities.
End-to-End Protection
Your data is encrypted
in transit and at rest.
Continuous Monitoring
We monitor, detect and
respond to threats proactively.
3. Infrastructure Security
GateConsole is hosted on secure, trusted cloud infrastructure with multiple layers of protection including network isolation, firewalls, intrusion detection, and regular security audits.
4. Compliance
We follow industry best practices and are working towards compliance with globally recognized standards.
Status shown is as of January 15, 2026. Certifications marked in progress or planned have not been awarded yet. Ask us for the current status of any of them.
5. Data Security
GateConsole sits in the path of your AI traffic, so we protect the data that flows through it, and the credentials that unlock your providers, at every step.
Encrypted in transit
All traffic between your applications, GateConsole and your providers uses TLS.
Encrypted at rest
Stored data, including usage logs and configuration, is encrypted.
Protected credentials
Provider keys and API keys are stored encrypted and masked in the dashboard.
Workspace isolation
Each customer’s data is logically separated from every other customer’s.
Sensitive-data guardrails
Policies can detect, mask or block sensitive content before it reaches a provider.
Never used for training
We do not use your prompts or responses to train AI models.
How we handle personal data, and how long we keep it, is described in our Privacy Policy.
6. Access Control
Access to GateConsole is limited to the people and applications that need it, and each is limited to what it needs.
- Role-based access through Teams & RBAC
- Least privilege by default for new members and keys
- Separate API keys per application, simple to rotate or revoke
- Team and application boundaries inside a workspace
- Changes to roles, keys and policies recorded in Audit Logs
- GateConsole staff access to production limited to those who need it, and logged
7. Monitoring & Logging
We watch the platform as closely as GateConsole helps you watch your own AI usage.
Platform monitoring
Service health, performance and errors are monitored continuously.
Threat detection
We look for abuse, credential misuse and unusual traffic, and act on what we find.
Audit trail
Security-relevant events are logged and kept so they can be investigated.
You get the same visibility into your own workspace through Audit Logs and Alerts, so your team can spot unusual usage early.
8. Incident Response
We keep a documented incident response process and review it regularly. When something goes wrong, this is how we handle it.
- 1
Detect
Monitoring and reports surface the issue.
- 2
Contain
We limit the impact and secure affected systems.
- 3
Investigate
We find the cause and what was affected.
- 4
Notify
Affected customers are told without undue delay, and as the law requires.
- 5
Improve
We review what happened and strengthen our defences.
9. Vulnerability Management
We look for weaknesses, and fix them, before they can be used against you.
Scanning
Code dependencies, container images and infrastructure are scanned for known vulnerabilities.
Patching
Fixes are prioritised by severity and applied promptly.
Security audits
We carry out regular security audits and reviews of the platform.
Responsible disclosure
Found something? Email security@gateconsole.com with the details. Please do not access other customers’ data or disrupt the service, and give us reasonable time to respond before sharing anything publicly.
10. Data Residency
Our production environment runs on AWS. Customer Data is stored and processed in the region where that environment is hosted.
Your model providers are separate
When GateConsole routes a request to a model provider, the prompt is processed where that provider runs it, under the provider’s own terms. Choose providers and regions in Models & Providers that fit your own residency requirements. If you have specific residency needs, contact us before you route sensitive data through the platform.
11. Contact Us
Questions about security, a vulnerability to report, or a security review for your organization? Our team will get back to you.