Login AI
AI security gateway
We intercept model requests and check them before and after generation. The gateway blocks injections, masks personal data, limits access, and writes a log for review.
We place a gateway in front of the LLM: prompt injection filters, DLP, PII masking, and a request log.
Pricing
from ₽600,000
per project
This is the lower bound of a project. We scope the exact quote after a brief: it depends on volume and the number of integrations.
Capabilities
Input filters
We check prompts and attachments with rules and a classifier. Suspicious patterns are blocked or sent for human review.
DLP and PII
We find personal data, keys, and contract numbers in requests and responses. We mask fields before sending to the model and restore them after.
Access and limits
We bind the gateway to roles and application keys. We count requests per user and project and add quotas and rate limits.
Log and review
We write the request, response, triggered rules, and latency to a log. An incident shows which prompt passed and what the model returned.
From request to result
1
Threat model
We review the application, models, and data. We record which attacks and leaks are critical for the perimeter.
2
Gateway design
We choose interception points, rules, and a masking scheme. We calculate the latency budget and throughput.
3
Integration
We connect the gateway to the application and models. We set roles, keys, quotas, and the log.
4
Red team
We test the gateway with attacks and legitimate requests. We tune thresholds and record false positives.
Check if it fits you
Good fit
An external LLM
The application sends data to a cloud model. The gateway checks requests and responses on the way to the provider.
PII in requests
Users send names, phones, addresses, or documents. DLP masks fields before they reach the model.
Not a fit
No application owner
The gateway sits in the application flow and needs an owner for releases and rules. Without one the project stops at design.
A 5 ms latency budget
Filters add 15–40 ms. With a hard 5 ms budget we move part of the checks into an asynchronous stage.
What you get
15–40 ms
Latency 15–40 ms
Filters add 15–40 ms per request on a test perimeter. We measure latency at each step and show it on the dashboard.
100%
100% of requests
Every model request passes through the gateway and enters the log. A record holds the user, rule, and check result.
2 weeks
2 weeks
A pilot on one application takes about two weeks. The timeline includes the threat model, integration, and red team.
What the delivery includes
Gateway
The gateway intercepts requests and responses, applies rules, and exposes metrics. Code, configuration, and the deployment scheme are included.
Rule pack
The rule pack covers injections, PII, keys, and blocked topics. Every rule has a test and an owner.
Dashboard
The dashboard shows requests, blocks, latency, and false positives. Security sees load and incidents in one place.
How the system is built
Interception
The gateway sits between the application and the model and intercepts every request. It sees the prompt, attachments, user, and context, so checks rest on the real data flow.
Input checks
On input, rules and a classifier look for injections, PII, and blocked data. On output, the gateway restores masked placeholders, checks the response for new leaks, and masks any fragments it finds before returning the response to the application.
Logging
Logging keeps every request, response, and triggered rule in a record with per-step latency. The record provides material for incident review and threshold tuning.
Where the solution pushes back
- 01
Latency
Filters add 15–40 ms per request. For chat the delay stays invisible, while a voice flow gets a separate latency measurement and heavy checks move to an asynchronous stage.
- 02
False positives
DLP rules produce false positives on non-standard data. We tune the threshold on a pilot and keep an exception list with an owner.
- 03
Rules and owner
The gateway applies rules approved by security. We deliver the policy and update process, and the risk decision stays with the owner.
Technologies
The technologies we use in our work and their role in a project.
Gateway and observability
We run the gateway in Kubernetes, check roles through Keycloak, trace requests in Langfuse, store rules and logs in PostgreSQL, and send events to Kafka.
Cost calculator
This is an indicative range, not a quote. We scope the exact estimate after a brief: it depends on volume and the number of integrations.
Applications
Traffic
DLP package
Audit log
Add-ons
Support
Year one: updates and monitoring, a reply within 2 business days.
Service
AI security gateway
The estimate covers our team's work. Hardware, third-party service licences and travel are added on request.
Estimated cost
₽840,000
Timeline
4 wk
Frequently asked questions
How much does the gateway cost?
The base delivery starts at RUB 600,000 and covers the gateway, rules, logging, and red team. The number of applications and traffic affect the timeline and estimate.
How much latency does it add?
On a test perimeter the filters add 15–40 ms per request. We move heavy checks, such as document parsing, into an asynchronous stage.
What about false positives?
We tune thresholds on a pilot with a labelled request set. Exceptions live in a list with an owner and a review date.
Where do you deploy the gateway?
In your cloud or on your servers. We support Kubernetes and virtual machines, and connect external models through their API.
What teams add to this service
Related Services
AI security audit
We check that the agent stays within its rights and resists an injection.
AI Infrastructure & RAG
Integrating large language models into closed corporate perimeters with guaranteed data protection.
Deterministic RAG systems
The model answers from 3–4 verified fragments and cites each source.
Part of Solutions
Ready to discuss your task?
Leave a request – we'll get back with a proposal and a preliminary estimate.
Contact us