Security architecture
What we protect, how, and what we don’t claim.
ModelGate sits in the request path between your application and a model provider. That position is useful — it is the one place a policy can apply to every model at once — and it is also a responsibility. This page describes the mechanisms precisely enough to be checked.
The shape of the system
Your application sends a chat-completions request to the gateway with a ModelGate API key in the x-api-key header. The gateway authenticates it, applies your project’s ceilings, optionally scans the untrusted input, calls the provider with the credential you stored, optionally scans the response, then logs the call and returns it. Requests that fail — bad key, oversized prompt, rate limit, spend cap, guardrail block, provider error — are logged too.
What is stored
| Data | Detail | State |
|---|---|---|
| Request metadata | Timestamp, provider, model, token counts, computed cost, latency, cache-hit, waste score and flags, and one-way hashes of the prompt, request shape and response. | Always on |
| Prompt (request) bodies | Stored only when you enable prompt storage on a project — so recommendations can quote the request that caused them. The model's response is never written to the request log. | Off by default |
| Cached responses | Only when automatic caching is on. Entries are keyed by prompt hash, model and temperature, and expire after 24 hours. | Off by default |
| Guardrail incidents | The rule that matched, its severity, and a snippet with the sensitive value itself replaced by first-three ••••••last-two. The raw value is never written down. | Off by default |
| Provider API keys | Encrypted with AES-256-GCM under a master key held outside the database, with a key-version field for rotation. Only a first-four-last-four hint is ever displayed back. | Always on |
| ModelGate API keys | Shown once at creation, then stored as a salted HMAC-SHA256 digest with a server-side pepper and compared in constant time. Revocable from the dashboard; a revoked key stops working immediately. | Always on |
| Card and bank details | Never seen by ModelGate. Payments go through PayPal; we keep a subscription identifier and invoice records. | Never stored |
Prompt storage is off by default at the schema level, not merely in the user interface. See the Privacy Policy for retention, subprocessors and your rights.
Traffic guardrails
Each category is a per-project setting with three levels. Detect records the incident and changes nothing about the request. Enforce acts: an injected request is refused before a provider is called, and a leaked secret or personal detail is redacted before the response is returned. All three ship off.
| Capability | What it does | State |
|---|---|---|
| Prompt-injection scan (inbound) OFF → DETECT → ENFORCE | Ten weighted signals over the untrusted portion of a request — everything that is not your system prompt. Score 0–100; recorded at 35, refused with 403 at 50 in enforce mode. | Off by default |
| Secret-leak scan (outbound) OFF → DETECT → ENFORCE | Seventeen credential signatures plus a Shannon-entropy pass over the response. Enforce replaces each match with a typed marker such as [REDACTED:OPENAI_API_KEY]. | Off by default |
| Personal-data scan (outbound) OFF → DETECT → ENFORCE | Email addresses, Luhn-valid card numbers, range-checked US Social Security numbers, phone numbers, IP addresses, IBANs. Enforce masks them before the response returns. | Off by default |
| Security alert email Enabled per project | One throttled message when an incident at or above the configured severity is recorded — masked snippets only. Defaults to high severity, and needs a mail provider configured. | Off by default |
| Streaming under enforce Refused under outbound enforce | Streaming (stream: true) is supported and inbound injection enforcement still applies. But outbound secret/PII ENFORCE can't redact a response it hasn't fully seen, so a streamed request is refused with 409 while that's on — detection still logs after the stream closes. | Off by default |
What these detectors are, honestly
They are pattern and heuristic detectors, not proofs. The injection scorer catches the well-known families — instruction override, system-prompt exfiltration, role hijack, jailbreak personas, safety bypass, chat-template injection, invisible characters — and it will not catch a phrasing nobody has written down yet. The secret detector favours precision over recall: a false “you leaked a key” that redacts a real answer is worse than missing an exotic token format. Run them in detect mode first and read your own incident log before you switch on enforce.
Limits enforced before you are billed
- Requests per minute, per API key — over the ceiling returns
429with aretry-after. - Maximum prompt and output tokens — over the ceiling returns
413, before a provider is called. - Monthly spend cap — the month’s recorded provider spend is checked before every call; over the cap returns
402.
New projects are created with all four set: 60 requests/minute, 8,000 prompt tokens, 1,024 output tokens and a $5 monthly cap. They are yours to raise.
Cost integrity
Costs are computed from token counts the provider returns and rates from a versioned price table, using BigInt fixed-point arithmetic rather than floating point. There is no estimation path: if a model has no rate row valid at the time of the call, the request is logged with no cost and a PRICE_MISSING marker rather than a plausible-looking guess — and the response you already paid for is still returned.
What we do not claim
ModelGate is a new product. Rather than leave you to infer, here is what we have not done:
- No SOC 2, ISO 27001, HIPAA or PCI certification, and no audit in progress.
- No third-party penetration test or external security review.
- No bug-bounty programme.
- No data-residency guarantee — see the Privacy Policy for where our subprocessors operate.
- No uptime commitment or SLA. The status page is a live probe, not a record.
If your procurement process requires any of these, we would rather you know now than discover it three weeks in.
Reporting a vulnerability
Email support@modelgatehq.com with enough detail to reproduce it. There is no dedicated security mailbox yet; this address is monitored. Please give us a reasonable window to fix an issue before publishing it.