Skip to main content
The Guardway gateway is a single container that runs inside your network and speaks an OpenAI-compatible API. Your applications send requests to the gateway; the gateway applies guardrails, picks a provider, forwards the request, and returns the response. The dashboard at app.guardway.ai configures and observes gateways but never proxies inference traffic. Prompts and completions stay on the gateway; only aggregate telemetry and administrative audit events are recorded centrally on the platform.

​
How the pieces fit together

Architecture diagram

Guardway at a glance

Gateway (your infra)

A hardened container. Runs in your VPC, on-prem, or on a laptop. Speaks the OpenAI API. Fans out to 20+ providers. Keeps prompts and completions on your infra.

Dashboard (SaaS)

Configures providers, routes, guardrails, budgets, and teams. Reads aggregate telemetry from gateways. Never sees raw prompts or completions.

Control plane

Registration tokens, heartbeats, config sync, health signals. HTTPS only. Outbound from the gateway.

Local connection

For playground, logs, and traces the dashboard talks to the gateway directly over your LAN or a URL you expose. Authenticated with a per-session JWT.

​
What stays local, always

Prompts and completions never leave the gateway. The gateway forwards requests directly to the provider you configured; only aggregate telemetry (token counts, latency, cost) and administrative audit events flow to the cloud dashboard. See Privacy and Security.

​
Keys for machines running the agent

Applications are not the only thing that calls the gateway. Every machine running the Guardway agent gets its own gateway API key, created automatically at its first check-in, so you can revoke or attribute spend to a single laptop without touching the rest of the fleet. A policy can carry an Access Profile — a reusable set of limits (allowed models, request and token rates, a budget, an expiry window) that every key created for that policy’s machines inherits, and that the gateway enforces per key like any other. Set it once on the policy instead of editing each key. See Access Profiles.

​
Where to go next

Deploy the gateway

Run the container.

Check requirements

CPU, memory, network.

Size the host

VM, disk and retention for 100k, 1M and 10M requests a day.

Functionalities

Auth, RBAC, guardrails, compliance.

Environment variables

Full config reference.

SaaS Gateway (Beta)

Don’t want to run infrastructure? We host the gateway for you.