Secure AI use
SSO-authenticated requests, per-user model allowlists, and a deny-by-default egress gate. Data only reaches destinations you've authorized — CUI never leaves the boundary.
Built for defense & regulated industry
Govern AI use.
Contain AI spend.
SecRouter is the secure API gateway between your teams and every model — authenticating every request, enforcing policy, controlling egress, and capping spend across the organization. One endpoint. Total control.
Self-hostedDeny-by-default egressAir-gap ready
NIST SP 800-171 R2/CMMC L3 control mapping/FIPS-aware/
OIDC SSO + MFA/Deny-by-default egress/Self-hosted or GovCloud
The control plane for AI
Shadow AI is a security incident and a budget leak. SecRouter closes both.
Sit between your people and the models. Inspect every request, enforce every policy, and meter every dollar — without slowing teams down.
Contain IT spend
Hard budgets and rate limits per group and user. Route each request to the cheapest capable model and cut off runaway usage before the invoice arrives.
Prove governance
Hash-chained, tamper-evident audit of every request, decision, and route — metadata only, never prompt content. RBAC and SSO, with exportable evidence for auditors and accreditation.
Drop-in architecture
One endpoint in front of every model
Point your existing SDKs at SecRouter. Change the base URL — keep your code.
Your teams & apps
Analyst tooling
Internal copilots
Batch pipelines
SecRouter control plane
AuthenticateEnforce policy
Gate egressMeter spend
Route to best / cheapest model
Log every decision
Model providers
Commercial APIs
GovCloud endpoints
Self-hosted / open
Security & deployment
Deployed where your data is allowed to live
Run SecRouter fully self-hosted, in GovCloud, or air-gapped. Nothing leaves your boundary unless policy says so — and you hold the keys.
Read the security brief →Air-gapped install
No outbound calls required — route only to in-boundary or GovCloud endpoints.
RBAC & SSO
OIDC SSO with MFA; group and role policy mapped to your IdP.
Metadata-only logs
Prompt and response content is never stored — only decisions, counts, and hashes.
Tamper-evident logs
Hash-chained audit trail, exportable for accreditation.
Cost control
Every token has an owner and a ceiling
Attribute spend down to the principal, set hard caps, and route to cheaper models automatically. Finance gets one bill; IT gets the controls.
- 01 Per-group and per-user budgets with rate limits and hard auto-cutoff
- 02 Smart routing trims spend by sending easy calls to small models
- 03 Per-user, per-model, per-day usage you can export for chargeback
Everything IT needs to say yes to AI
SSO & MFA
OIDC, group-mapped policy
Model allowlists
Approve models per group
Budget caps
Hard caps & auto-cutoff
Smart routing
Cheapest capable model
Egress control
Deny-by-default allow-list
Audit logging
Hash-chained, metadata-only
Per-user quotas
Request & token rate limits
Self-hosted
Air-gap & GovCloud
Put a control plane
in front of AI.
Map SecRouter to your environment and compliance posture — or clone it and bring up the secured test stack in one command.