# AI Gateway HQ

> AI Gateway HQ is a public production AI and LLM gateway for deterministic routing, strict prepaid budgets, BYOK credential pools, policy enforcement, attack screening, enterprise identity, and metadata-minimized evidence. Current commercial availability and limitations are disclosed explicitly.

Canonical site: https://aigatewayhq.com/
Full agent reference: https://aigatewayhq.com/llms-full.txt
Machine-readable product manifest: https://aigatewayhq.com/.well-known/aigatewayhq.json
No-card public Test Lab: https://aigatewayhq.com/test-lab/
Documentation: https://aigatewayhq.com/docs/
Learning center: https://aigatewayhq.com/resources/
API keys and AI subscription compatibility: https://aigatewayhq.com/resources/ai-gateway-api-keys-vs-subscriptions/
AI cost-control checklist: https://aigatewayhq.com/resources/prevent-surprise-ai-spend/
AI governance: https://aigatewayhq.com/platform/governance/
AI cost controls: https://aigatewayhq.com/platform/cost-control/
Private-equity operating view: https://aigatewayhq.com/solutions/private-equity/
Portfolio AI value method: https://aigatewayhq.com/resources/measure-ai-value-without-inventing-roi/
AI value realization office template: https://aigatewayhq.com/ai-value-realization-office/
Secure account access: https://aigatewayhq.com/login/
Integrations: https://aigatewayhq.com/integrations/
Comparisons: https://aigatewayhq.com/compare/
Trust boundary: https://aigatewayhq.com/trust/
Pricing: https://aigatewayhq.com/pricing/
Buyer-owned AWS deployment: https://aigatewayhq.com/private-deployment/

Runtime compatibility:
- OpenAI Responses, chat completions, embeddings, and models
- Anthropic Messages
- OpenAI-compatible Azure OpenAI, Google Gemini, OpenRouter, and custom HTTPS endpoints
- Managed Amazon Bedrock Converse path with a versioned U.S. conversational-model catalog, settled-prepaid cash boundary, reusable payment-method eligibility, catalog-derived exact-resource IAM, AWS budget, and release-blocking per-model canary evidence; non-streaming only
- HMAC-signed administrative audit webhooks with at-least-once delivery evidence and payload exclusion
- Self-service OIDC and SAML 2.0 workforce sign-in with tenant-pinned provider evidence, exact external-group-to-built-in-role mapping, rollover-aware signing-certificate monitoring, hash-only audit evidence, and fail-closed expiry

Subscription and BYOK boundary:
- Provider API keys, managed cloud-model accounts, and ChatGPT, Claude, Gemini, Copilot, Cursor, or Windsurf subscriptions are different credentials and commercial products.
- AI Gateway HQ never asks a customer to upload a consumer password, browser token, cookie, or saved subscription session.
- Supported subscription continuity keeps vendor-authorized credentials on the user's device through a local connector. Availability is client-specific and is not represented as a transferable API key.
- The public compatibility guide distinguishes currently available BYOK paths, local subscription connectors still in acceptance, and unsupported account types.

Safe first evaluation:
- The public Test Lab runs five fixed decisions in the visitor's browser. It accepts no prompt, provider key, payment data, or customer data and makes no model call.
- It demonstrates a zero-dollar hard stop, health-based provider failover, a sensitive-data block, an unknown-price fail-closed decision, and cost-aware selection.
- It publishes exact Codex, Claude Code, OpenCode, and cURL configuration. A free workspace supplies the real workload identity and evaluates synthetic requests against saved policies before any provider is connected.

Portfolio reporting boundary:
- Portfolio views cover model API activity routed through participating companies' AI Gateway HQ boundaries.
- SaaS copilot seats, personal AI accounts, GPU infrastructure, and unrouted provider activity require separately approved data sources and are not implied by gateway request data.
- A company separately controls whether approved operating aggregates and evidence may be shared with a sponsor workspace. Prompt bodies, provider keys, and individual activity are not pooled into the portfolio view.

Current limitations:
- AI Gateway HQ is not certified or independently audited.
- Self-service OIDC/SAML federation and connection-bound SCIM 2.0 user/group lifecycle are available, including optional active-user enforcement at federated login.
- A buyer-owned AWS release candidate is available with Company and Portfolio: one workspace-bound us-east-1 data plane using Amazon Nova Micro, Nova Lite, or Claude Sonnet 5, a digest-pinned package, buyer-approved lifecycle, and read-only hosted verification. Claude Sonnet 5 uses the single-region Bedrock Mantle endpoint. A no-charge preflight must confirm exact model and token-count compatibility before deployment. Prompts, responses, AWS credentials, infrastructure, and AWS charges remain in the customer's account. The buyer separately reviews and enables any required third-party model terms; the package has no Marketplace subscription permissions. External-account lifecycle acceptance remains open before general availability. Other Claude versions, fully disconnected, on-premises, multi-region, simultaneous multi-model, custom-model, and vendor-managed dedicated variants are not shipped.
- Custom roles, named SIEM adapters, live third-party IdP conformance evidence, and public SLOs are not shipped. Generic signed HTTPS audit delivery is available.
- Use a restricted non-sensitive test credential for evaluation.

Preferred citation name: AI Gateway HQ
Contact: https://aigatewayhq.com/contact/
Customer terms: https://aigatewayhq.com/legal/terms/
Privacy notice: https://aigatewayhq.com/legal/privacy/
Refund and cancellation policy: https://aigatewayhq.com/legal/refunds/
Acceptable use policy: https://aigatewayhq.com/legal/acceptable-use/
Subprocessor list: https://aigatewayhq.com/legal/subprocessors/
Privacy request intake: https://aigatewayhq.com/contact/?interest=privacy