Every AI action. One enforced path.
LLM gateways govern what AI says. Gatekeeper governs what AI does, deciding every tool call inside an enclave where no server outside holds a key.
People, AI tools & bots
One enforced path
Protected systems
See what your people and AI tools are doing.
Every tool call carries an identity chain: the person, the AI tool they're driving, and the system it reached. Start in monitor mode and see everything before you enforce anything.
Live activity
Monitor modeControl what every person, AI tool, and bot can do, and what they can connect to.
Write policy once for people, AI tools, and autonomous bots alike, from someone working in Claude to an agent like Grok or Dots acting on its own. Gatekeeper enforces it on every call, before anything runs.
And any other MCP server, REST, or gRPC API
- Allowed
- Needs approval
- Denied
- Denied by default
- Approval for the exact requestA human approves the exact parameters, and only that request runs. Once.
- Limits checked before the callSpend caps, rate limits, and transaction size are enforced before anything executes, not reconciled after.
- Deny by default, fail closedAnything without a rule is denied. If Gatekeeper is unreachable, calls stop instead of slipping through.
Credentials your AI never holds.
Most AI gateways keep your API keys on an ordinary server. Gatekeeper seals them inside a hardware vault, so your AI tools get results, never the keys behind them.
- Sealed in hardwareKeys unlock only inside an attested AWS Nitro Enclave, one approved call at a time.
- Results, not secretsThe credential never reaches the model, the tool, or the prompt.
- Not even Station70 can read themOur engineers and servers can't decrypt them. Verify it yourself.
Credential · github_token
Encrypted. Decrypts only in here.
Technical deep dive
Request the Gatekeeper technical whitepaper
Architecture, threat model, and cryptographic design in depth. Reviewed and sent personally by our team.
Request received. Our team will review it and send the whitepaper to your inbox.
Prove the control was on.
AI is moving faster than the rules around it, and the rules are arriving. Auditors will ask what every AI tool and bot did, and who allowed it. Gatekeeper records every decision, denies included, as signed evidence you can hand straight over.
Decision receipt
rcpt 8f21c- Person
- m.chen@acme.com
- AI tool
- Cursor
- Requested
- github.pull_request.merge
- Policy
- engineering.v4 · rule 2
- Decision
- Denied · did not execute
- Recorded
- 08 Oct 2026 · 14:02:11 UTC
Evidence mapped to the frameworks your auditors use
- SOC 2Logical access, change authorization, monitoring✓ Evidence ready
- ISO 27001Access control and logging✓ Evidence ready
- ISO 42001AI system inventory and operating records✓ Evidence ready
- NIST AI RMFGovern and measure✓ Evidence ready
- EU AI ActRecord keeping and human oversight✓ Evidence ready
- DORAICT access control and incident evidence✓ Evidence ready
Station70 is SOC 2 Type 2. Visit the trust center (opens in a new tab)
Watch first. Enforce when ready.
Our engineers connect one workflow in monitor mode and map what would be allowed, denied, and held for approval. You don't hire for this.
- SaaS
- Self hosted in your VPC
- Dedicated instance