# Is an AI gateway secure?

> An AI gateway can improve security by centralizing provider credentials, model allowlists, spend controls and request evidence. It also becomes a sensitive intermediary that may see prompts, files, tool arguments and outputs. Security depends on the deployed architecture, identity controls, logging policy, data retention, encryption, tenant isolation, upstream contracts and the customer's own prompt and tool design.

_Last reviewed 2026-08-15 · [Editorial review](https://keeprouter.com/editorial-policy#editorial-team)_

## Treat the gateway as a trust boundary

| Area | Questions to answer before production |
|---|---|
| Identity | How are users, services and environments separated? Can keys be scoped and revoked? |
| Upstream credentials | Who stores them, how are they encrypted, and can operators retrieve plaintext? |
| Request data | Are prompts, files, tool inputs, outputs or headers logged? Can sensitive fields be excluded? |
| Retention | What is retained, where, for how long, and under which deletion process? |
| Routing | Can a request cross providers, regions or data policies without explicit approval? |
| Tenancy | How are logs, usage, limits and credentials isolated between customers or teams? |
| Incident response | Which request ID, audit record, status history and contact path are available? |

A security page or certification is useful evidence, but it does not replace a data-flow review for your exact route. A gateway can offer a zero-retention option while another logging feature remains enabled. A provider route can have different terms from the gateway itself.

## Centralization helps and concentrates risk

Replacing provider keys scattered across applications with scoped gateway keys can simplify rotation and least privilege. Model allowlists and per-key limits can reduce accidental spend or access. A single evidence trail can improve investigation.

The same concentration raises the impact of a gateway credential leak or policy error. A broadly scoped key may reach several expensive models. A compromised control plane could change routing or expose logs. Use separate keys by environment and service, narrow model scope, short operational access paths, and alerting tied to usage anomalies. Review [KeepRouter security and data handling](/security) for the public KeepRouter contract.

## A gateway does not solve model-layer threats

Prompt injection, insecure tool design, excessive agency, sensitive-data disclosure and unsafe output handling remain application concerns. The gateway may offer filters or guardrails, but your application still decides which tools exist, what authority they have, and whether model output can trigger a side effect. Treat all model-generated tool arguments as untrusted input.

## A practical review

1. Draw the request path from user to gateway to every eligible provider.
2. Classify every field and decide whether it may be logged.
3. Verify key scope, revocation, rotation and environment separation.
4. Test tenant isolation and authorization failures.
5. Confirm region, retention, deletion and subprocessor requirements.
6. Exercise an incident with request IDs, audit evidence and a provider outage.
7. Revisit the review whenever routing, logging, models or tools change.

Use the [managed versus self-hosted comparison](/compare/managed-vs-self-hosted-ai-gateways) to decide where this trust boundary should run. The [AI gateway evaluation guide](/blog/evaluate-ai-gateway) turns the questions into evidence checks.

## Frequently asked questions

### Does a gateway keep prompts private?

Only under its documented logging, retention and routing policies. Review the exact plan and provider path, then configure sensitive-data handling explicitly.

### Is self-hosting always more secure?

No. It gives more infrastructure control and also makes your team responsible for patching, secrets, isolation, backups and incident response.

### Should one key access every model?

Production keys should normally use the narrowest model, endpoint and spend scope that the workload needs.

### Can a gateway stop prompt injection?

A filter may reduce some attacks, but prompt injection is an application and tool-authority problem that no gateway can eliminate universally.

### What should an incident record contain?

Keep request identifiers, identity, route and model decisions, status, timestamps, usage and policy changes without retaining more sensitive content than necessary.

## Sources reviewed

1. [OWASP Top 10 for LLM applications](https://genai.owasp.org/llm-top-10/)
2. [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework)
3. [Cloudflare AI Gateway data loss prevention](https://developers.cloudflare.com/ai-gateway/features/dlp/)
4. [KeepRouter security and data handling](https://keeprouter.com/security)

## Related guides

- [security](https://keeprouter.com/security.md)
- [AI gateway security checklist: map the data path before trusting the control plane](https://keeprouter.com/blog/ai-gateway-security-checklist.md)
- [Managed vs self-hosted AI gateways](https://keeprouter.com/compare/managed-vs-self-hosted-ai-gateways.md)
- [How to evaluate an AI gateway with a proof-based scorecard](https://keeprouter.com/blog/evaluate-ai-gateway.md)
- [API observability](https://keeprouter.com/features/api-observability.md)
- [What is a BYOK AI gateway?](https://keeprouter.com/answers/what-is-byok-ai-gateway.md)

## Test the contract with a real model

Create a narrowly scoped key, select a model from the live catalog, and run the exact request shape your application depends on.

[Create a free key](https://keeprouter.com/login?returnTo=%2Fconsole%2Fkeys%3Fmodel%3Dfree) · [Live models and pricing](https://keeprouter.com/models.md)