One endpoint to every model.
The evidence is produced on the way through.
MODELGATE is an OpenAI-compatible gateway to the major models — Claude, GPT, Gemini, Mistral, Llama and the open weights — where security, integrity, jurisdiction and EU AI Act evidence are applied to every call before the response returns. Your keys are never stored and your ceilings are enforced before the call. Inspection overhead: 0.28 ms at p95, measured, against a 100 ms ceiling. The model's own time is the only latency you notice.
Trust primitives BUILT · MEASURED
Each one answers a documented failure of an existing gateway. None is speculative.
Bring your own key
Your provider key travels in one header for one request and is never stored. We cannot leak what we never hold.
Hard budget ceilings
Per-day, per-month, per-call euro ceilings, calls per minute, tokens per call. Checked before any byte leaves; a ceiling of zero is a freeze. A looping agent hits a wall, not an invoice.
Honest failure codes
Every failure says client, customer, provider or MODELGATE, and whether to retry.
Graceful queueing
Past your concurrency slots a request is held, not dropped, and told when to retry. Provider throttling is absorbed for you.
A published SLA
Availability computed from our own request ledger per tenant. Provider failures and your own policy refusals are excluded from both sides of the fraction. Zero traffic reads UNVERIFIED - never 100%.
The compliance layer BUILT · MEASURED
This is the part a regulated buyer cannot get from a routing product, and the part we are native to.
Jurisdiction-locked routing
Every provider carries its legal home and where it processes. You declare the blocs you permit; a route outside them is refused with the provider and jurisdiction named. Failover stays inside your set. DeepSeek and Qwen are in the catalogue so the lock is demonstrable, not theoretical.
Zero-retention with proof
Not a sentence on a pricing page: a retention statement per request - prompt and response hashes, bytes seen, bytes retained (zero) - signed post-quantum by a key in hardware custody. Verify it with the public key and your own texts; the content is not needed to verify.
EU AI Act Article 12 / 14 evidence
One hash-chained record per request, at no cost to the request. Every refusal raises an Article 14 oversight event a person can acknowledge. The export carries denominators: records chained, events reached a human.
Sector overlays
Each overlay is a machine-checkable set of controls mapped to the article it answers, assessed against your live configuration. You get a number and a list of named gaps, never an adjective.
What is public today
Two surfaces need no key, so you can read the contract before you talk to us.
The gateway itself answers only a tenant key; tenants are provisioned by us.
Scope note. MODELGATE admits the variant that is served — the weights, the harness around them and the pinned client — not the name on the card; a change in any of the three is drift and means re-admission. The name is not what your superintelligent AI agents are talking to.
Behavioural admission BUILT · MEASURED
A file scanner tells you what a model file looks like. It cannot see a backdoor trained into the weights, and a scanner can itself be evaded, rewritten or forged. Behavioural admission tests what the model does, run by our runner, and signs the result.
Does it refuse what it should?
Must-refuse and must-answer prompts, measured against the declared baseline. A model whose refusals were quietly removed is refused.
Does it change on a hidden trigger?
The same task with and without candidate triggers. A model whose behaviour flips on a trigger is refused, with the trigger named.
Does it call tools nobody asked for?
Tasks with a declared tool set. Any call outside it, or any call when none was requested, is refused.
Format and hashes, by us
Safetensors only — every pickle-class format is refused outright — and every component checked against its baseline: weights, adapter, tokenizer, chat template, runtime, sampling.
Your scanner’s PASS never opens our gate
Keep the file scanner you already own. Its FAIL refuses the model; its PASS is recorded and ignored for admission. The admission is a signed ADMIT or REFUSE record per model version, verifiable with nothing but the record and our public key.
€4,997 / month
or €59,964 / year. Everything above in one price, nothing to wire. Pay by card.
€89,997 / model / year
Re-admission on every new version, beside the scanner you already own. Contact sales.
Contact sales
Up to 10 models, or unlimited models with your own trigger and tool batteries added to ours.
Pricing
Not published yet, on purpose. MODELGATE is priced as a subscription, never as a percentage of your inference spend, and the tiers are being set with the compliance officers who will use the Article 12 export — not by us in a room. If you produce AI Act Article 12 logging today by hand, we would like thirty minutes.
Route through the gate.
Bring your own keys. Set your ceilings. Lock your jurisdictions. Get the evidence on the way through.
Talk to usThe 131 doors