AI Gateway HQ
Buyer-owned AWS · release candidate

Run the AI gateway in your AWS account.

Keep model traffic, provider credentials, and the AWS bill inside an account you control. AI Gateway HQ supplies the signed release, spending limits, and lifecycle controls without receiving your prompts or long-lived AWS credentials.

Start with Company Review pricing
  • Included with Company
  • 0% inference markup
  • Buyer-approved lifecycle
Request pathYour traffic stays in your AWS account
Your application
AI Gateway HQ control plane Release entitlement, digest, stack status, limits, and aggregate request count only
Where each part runs

Control the data plane without taking on a black-box appliance.

The package installs a narrow, release-pinned gateway into your AWS account. Your team can inspect the CloudFormation template, approve every lifecycle action, and remove the stack. AI Gateway HQ can verify the declared stack through a read-only role. AI Gateway HQ cannot deploy, update, or delete resources in your account.

Inside your AWS account

Traffic, credentials, infrastructure, and provider charges

  • Model request and response bodies
  • AWS identity and provider access
  • VPC, endpoints, runtime, and counters
  • Bedrock usage and the AWS invoice
AI Gateway HQ control plane

Entitlement, signed release, and bounded status evidence

  • Workspace and subscription entitlement
  • Release version and package digest
  • Declared limits and stack identity
  • Read-only status and aggregate request count
From account to first request

Four buyer-approved steps.

The control plane prepares the release. Your AWS session performs every infrastructure change.

  1. 01

    Use a paid Company or Portfolio workspace

    The deployment is part of the software plan, not a separate inference reseller fee.

  2. 02

    Run preflight before creating anything

    Review the account, Region, VPC, subnets, routes, model access, service quotas, template, limits, and modeled cost.

  3. 03

    Launch the digest-pinned package locally

    The buyer-local launcher uses your active AWS session. AI Gateway HQ never receives a long-lived AWS credential.

  4. 04

    Verify, update, or remove on your terms

    Read-only verification confirms the stack and request counter. Updates and removal require explicit buyer approval.

Clear pricing

Software plan here. AWS bill there.

AI Gateway HQ does not add a percentage to the model bill. One deployment is included with Company and Portfolio; the customer pays AWS and Bedrock directly.

Company
$499per month
Portfolio
$1,500monthly base
Inference markup
0%customer pays AWS

The reviewed two-Availability-Zone example has a modeled known subtotal of $44.923464 per month: $44.64 for interface endpoints and $0.283464 for the modeled Bedrock usage. API Gateway, Lambda, DynamoDB, CloudWatch Logs, endpoint data processing, data transfer, taxes, and actual usage are variable and excluded. Review the live preflight before approving a stack.

Current release

Narrow by design. Not yet general availability.

The release candidate deliberately limits the first buyer-owned path. External-account deployment, renewal update, rollback, first-request, and removal acceptance remain open before general availability.

Region
us-east-1
Deployment
One workspace-bound stack
Daily limit
25 default · 100 maximum
Lifecycle
Buyer-approved changes only

Supported models are Amazon Nova Micro, Nova Lite, and Claude Sonnet 5. The default and frozen cost example use Nova Lite. Claude Sonnet 5 uses AWS's single-region Bedrock Mantle endpoint; Nova uses Bedrock Runtime. The package grants no Marketplace subscription permissions, so the buyer reviews and enables any required third-party model terms and payment in its own AWS account.

Not included in this release

  • Disconnected or on-premises operation
  • Multi-region or multi-model deployment
  • Automatic acceptance of third-party model terms
  • Vendor-managed dedicated AWS accounts
  • A formal SLA, certification, or assisted implementation
Before you deploy

Questions the security and finance teams will ask.

Does AI Gateway HQ receive prompts or responses?

No. In the buyer-owned AWS deployment, model request and response bodies stay in the customer's AWS account. The hosted control plane retains entitlement, release, stack, limit, status, and aggregate request-count evidence; it does not receive model traffic or AWS credentials.

Is this a fully self-hosted or disconnected product?

No. The data plane runs in the customer's AWS account and VPC, while entitlement, signed-release issuance, and read-only deployment verification remain in the AI Gateway HQ control plane. Disconnected, on-premises, multi-region, and vendor-managed dedicated variants are not included in this release candidate.

What does the first release support?

One workspace-bound deployment in AWS us-east-1 using Amazon Nova Micro, Nova Lite, or Claude Sonnet 5, with 25 requests per day by default and a hard maximum of 100 requests per day. A no-charge preflight must confirm the exact account, Region, model, and token-count path before deployment. The package is digest-pinned and supports buyer-approved creation, update, verification, and removal. Buyers select and authorize third-party model terms in their own AWS account.

What does it cost?

One deployment is included with the $499 monthly Company plan and the $1,500 monthly Portfolio base plan. AI Gateway HQ adds no inference markup. The customer pays AWS and Bedrock charges directly. The reviewed two-Availability-Zone example has a modeled known subtotal of $44.923464 per month; API Gateway, Lambda, DynamoDB, logging, data processing, transfer, taxes, and actual usage vary and are not included in that subtotal.

Evaluate the exact boundary

Start with the Company workspace.

Review the live cost preflight and release evidence before your AWS account creates anything.

Start with Company Review security