What is aisecuritygateway?

Occludra is an open-source AI security gateway that sits between your applications and LLM providers. It inspects every request for sensitive data — emails, SSNs, credit cards, API keys, and over a dozen other PII types using Microsoft Presidio — then redacts or blocks them before the request reaches the model. It also catches five prompt injection patterns and five secret types including AWS credentials and GitHub tokens. The gateway works as a drop-in replacement for the OpenAI SDK: just change the base URL and API key. It supports eight providers with bring-your-own-key configuration. The self-hosted version runs in two Docker containers, fails closed if the safety layer is unreachable, has zero telemetry, and includes API key authentication with rate limiting. The managed cloud adds enterprise features like single sign-on, role-based access, SIEM integration, on-premises deployment options, intelligent routing, caching, loop detection, and compliance logging.

Should you self-host aisecuritygateway?

aisecuritygateway scores 44/100 on selfhost.directory (how scoring works) and ranks #56 of 78 in Security. It has 49 GitHub stars.

It shipped 2 stable releases in the past year. The latest, v1.1.0, came out on 8 May 2026. New versions land roughly every 2 days.

Setup is moderate: expect some configuration beyond a single command. It is Apache-2.0-licensed and written mostly in Python.

Its closest alternative on selfhost.directory is pentagi (83/100, 32 653 stars). It scores higher overall, so compare the two before you pick. See aisecuritygateway vs pentagi side by side.

Features

API Key Authentication
DLP Policy Configuration
Fail-Closed Architecture
Health check endpoint
Model Discovery
Multi-provider routing
OpenAI Compatible API
PII redaction
Prompt Injection Blocking
Python SDK
Secret Detection
Secret Scrubbing in Logs
Zero telemetry

FAQ

Does Occludra work with AI agent frameworks like LangChain and CrewAI?

Yes. LangChain, LangGraph, CrewAI, AutoGen, Semantic Kernel, and virtually all production agent frameworks use /v1/chat/completions with tool/function calling — the exact endpoint Occludra proxies.

Can I cancel anytime?

Yes. Pro subscriptions are managed through Stripe — cancel with one click anytime. Wallet balances never expire.

How much does it slow down my app?

The security check adds less than 50 milliseconds for text, and 0.5–1 second for images depending on size. Every response includes timing headers.

Do I need to configure DLP rules before my data is protected?

No. Every request is protected from the first API call with a Maximum Protection default policy that scans for all 30+ entity types and redacts matches.

What if I don't have my own API keys?

Use the Managed Credits plan — add credits to your Occludra wallet and they handle everything using their own provider accounts.

What does BYOK mean?

BYOK stands for Bring Your Own Key — you provide your own API keys from providers like OpenAI, Google Gemini, xAI, Groq, or Together.ai, and Occludra uses them to make calls on your behalf at provider prices with zero markup.

Is this compatible with my existing code?

Yes. If your app uses the OpenAI SDK, you only need to change two lines: the API key and the base URL. Everything else stays the same.

Does Occludra store my data?

No. Only metadata like "1 email address was blocked" is logged — never the actual content of messages or AI responses.

What is Occludra in plain English?

It's a security layer that sits between your app and AI companies like OpenAI, Groq, or Mistral. When your app sends a message to AI, Occludra checks it first — removes any sensitive data (like emails, passwords, or credit card numbers), selects the most cost-efficient available provider, and then forwards the cleaned message.