Define the rules once.Enforce them on every request.
Decide which models, regions and data practices your organization allows. The gateway applies it to every team, key and request. Policy stops being a wiki page.
Only the models you allow
An allow-list for the organization, narrowed per team. Anything outside it is refused at the gateway, before a token is spent.
- Refused at the gatewayNot in code review, not by convention
- 600+ to choose fromAdd new releases when you are ready for them
403 {"error": {"message": "model not approved", "type": "policy_violation"}}
Keep the organization in region
Restrict the organization to the EU, US or APAC gateway. Requests sent through any other endpoint are rejected before they reach a model. No application change, no exceptions per developer.
- One setting, org-wideUnrestricted by default, one or more regions once set
- Inference is separateApprove region-pinned models to keep it in region too
Choose how providers handle your data
Restrict traffic to endpoints with zero data retention terms. The terms each request ran under stay on the record.
The terms a request ran under are recorded with the request.
Roles that match your org
Role based access across five layers: organization, group, service account, user, key. Platform teams hold the policy. Product teams ship inside it.
- Admins and membersAdmins set policy, members work inside it
- Access lists per keyOne key, only the models and features it needs
A record of who changed what
Policy edits, key events and refused requests, logged as they happen and exportable. Hand auditors the trail instead of reconstructing it.
Strip PII before it leaves
Redact PII before a request reaches any provider. Block prompt injection. Filter content against your policy.
Built to survive procurement
The questions security and legal ask, answered before they ask them.
SOC 2 Type II
Observation period under way with an independent auditor. Controls in place and documented; the target date is on the trust page.
GDPR, DPA on request
An Article 28 DPA, signed on request at any spend, with sub-processors listed.
EU residency
Frankfurt, on AWS eu-central-1, via router.eu.requesty.ai.
Zero data retention, pinnable
Pin your traffic to endpoints that retain nothing. 131 of the EU model endpoints qualify.
Enterprise adds the layer above the policy
Everything on this page is on every plan. Enterprise adds what a rollout needs around it: SSO, a procurement process run by people, and a DPA on request.
Put your policy on the request path
Approve the models, set the region, and let the gateway hold the line.