AI Gateway Security and Compliance
AI Gateway Security and Compliance
AI Gateway gives you controls over where your data goes and what providers can do with it. You can route only to providers with verified zero data retention agreements, prevent providers from training on your prompts, and restrict which providers serve traffic for your team. These controls work the same way regardless of which model you use.
What you can do
- Enforce data privacy: Route only to providers with verified ZDR agreements with Zero Data Retention
- Block training on prompts: Prevent providers from using your prompts for model training with Disallow Prompt Training
- Restrict providers: Limit which AI providers can serve requests across your team with the Provider Allowlist
- Restrict models: Control which AI models your team can use with the Model Allowlist
Features overview
| Feature | What it does | Key details |
|---|---|---|
| Zero Data Retention | Ensure data privacy compliance | Default ZDR policy, per-request enforcement, verified provider agreements |
| Disallow Prompt Training | Prevent prompts from training models | Per-request enforcement, verified provider agreements |
| Provider Allowlist | Restrict which providers serve requests | Team-wide policy for compliance; Pro and Enterprise plans |
Zero data retention
AI Gateway uses zero data retention by default. It permanently deletes your prompts and responses after requests complete. For applications with strict compliance requirements, you can also enforce ZDR at the provider level:
const result = await streamText({
model: 'anthropic/claude-opus-5',
prompt: 'Analyze this sensitive data...',
providerOptions: {
gateway: { zeroDataRetention: true },
},
});
When zeroDataRetention is enabled, requests only route to providers with verified ZDR agreements. See the ZDR documentation for the list of compliant providers.
Provider allowlist
The provider allowlist lets team owners restrict which AI providers can serve requests through AI Gateway. A request only returns 403 when no allowed provider can serve it. The feature is opt-in and available on Pro and Enterprise plans.
A common reason to enable this is compliance: your team has reviewed a specific set of providers, and you want to guarantee that AI Gateway never routes to one you haven't approved.
See the Provider Allowlist docs for configuration and pricing.
Next steps
- Enable ZDR for sensitive workloads
- Disallow prompt training for your data
- Restrict providers for compliance
Last updated September 8, 2026