Platform
An AI gateway that enforces your rules inside your own network
Your security team does not want a vendor sitting between your applications and the models they call, and prompts are not leaving the network for a governance tool. Edge is the part of Aicura you run yourself. An AI gateway, an OpenTelemetry collector and a few small engines sit in your network, enforce your guardrails on every request and send Aicura only counts, events and results. Aicura is never in the request path, and nothing inbound is opened.
Included in Pro and Enterprise. Compare plans
Everything that touches your AI traffic runs on your infrastructure
Each component is a container you run, configured from a file you hold, with secrets read from your environment or AWS Secrets Manager. Aicura sends them signed rules and settings, and they send back what they did. Start with a hub and add only the pieces you need.
Links your network to Aicura. The other components talk only to the hub.
Sit in front of AI traffic and enforce your guardrails, budgets and rate limits on each request.
Take the tracing and proxy logs you already produce and send Aicura usage figures, never content.
Run red-team tests and evaluations against your own deployments, on their own schedule.
Compare today's traffic with a baseline you hold and report what has shifted.
Answer a pipeline or release tool before it deploys, retires or trains a system.
One outbound connection to Aicura, and no open ports
The hub is a small relay that links your network to Aicura. Gateways, collectors and engines talk only to the hub, and the hub is the only thing that reaches Aicura. It holds nothing, buffers nothing and signs what it forwards with a key you generate, which never leaves your network.
- The connection to Aicura goes out from the hub. Aicura never connects in.
- Components collect new rules and settings by asking the hub for them.
- Data can reach the hub over HTTPS, or through an SQS queue or Kafka topic of your own.
Enforce your guardrails on every request, before it reaches the model
The Aicura gateway sits between your applications and the model providers. An application switches over by changing only its base URL. The gateway reads OpenAI, Anthropic, Bedrock, Google GenAI and Cohere request formats, and it can also sit in front of the MCP servers your agents call to use tools.
- It enforces the guardrail rules, budgets and rate limits you publish and deploy, and checks each signature before anything changes.
- Content scanners run in the gateway or beside it in your network, including your own scanner scripts and services you host.
- Provider API keys live in the gateway's configuration and are never sent to Aicura.
- Each system attached to a gateway has its own fail mode, open or closed, for when a rule cannot be checked.
Bring the AI gateway you already run
Already running Kong, Envoy with OPA or LiteLLM? Register it as your own gateway and point its logs at your hub. Refused requests arrive in Aicura as blocks, attributed to the system they belong to. Any other gateway can send the same events as plain JSON.
Each published guardrail version can be exported as a signed bundle in Rego for OPA, as a Bedrock Guardrails configuration or as generic JSON. Your gateway pulls the bundles you export. Rules a format cannot express are listed on the bundle, so nothing is silently left out.
Usage figures from the tracing you already have
Collectors are where your applications' tracing meets Aicura. A collector is an OpenTelemetry Collector that receives standard OTLP traces over HTTP or gRPC, from the Aicura gateway or from your own instrumentation. Full traces stay in your own observability stack.
A collector keeps only generative AI spans, following the OpenTelemetry GenAI semantic conventions and accepting the older OpenLLMetry attribute names. Prompt, completion and message content is removed in your network, and what reaches Aicura is per-minute counts, tokens and response times for each system, provider and model. Your billing exports and learning system can push billed spend and training records to the collector too, and those feed monitoring.
A collector can also read your proxy, secure web gateway or firewall logs, so you see AI use that never goes through a gateway. It keeps only the calls that go to an AI service, using Aicura's catalogue of AI products and providers, and drops everything else in your network. It works out the product, vendor and model there too. People, devices, addresses and paths leave only as hashes under a key you hold, and query strings and content never leave. In Aicura, calls your gateways already account for are told apart from the rest, and an AI service no register entry covers shows up in discovery.
Stays in your network
- Prompts, responses and system instructions
- Your network logs, and the key that hashes who and what they name
- Model provider API keys and credentials
- Test targets and the credentials to reach them
- Drift baselines and the content they are compared against
- Full traces in your own observability stack
- The hub's signing key
Reaches Aicura
- Blocks, redactions and budget breaches, with a sample of allowed requests
- Per-minute counts, tokens and response times for each system and model
- Agent decisions that bear on what an agent may do, with counts for the rest
- Billed spend lines and training records you push to the collector
- One record per AI call your network makes, with people, devices and addresses as hashes under your key
- Security test and drift results
- Each component's health and version
Attack your own deployments, without handing over the keys
A security engine runs red-team tests and evaluations from inside your environment. You set up each test in Aicura with its schedule and the systems it covers. The engine keeps its own clock, so tests keep running through an outage.
- The engine holds the address and credentials for each system it tests. They never reach Aicura.
- Each test hits your real deployment, not a generic model.
- Aicura only offers the test types the engine says it can run.
Notice when a system starts behaving differently
A drift engine compares current traffic with a baseline dataset you hold, across traffic, guardrail activity, response text and meaning. It receives spans from your collector inside your network, so any content it reads stays there. Only the statistics and a one-line explanation of each result reach Aicura, where they become figures you can set limits on.
Let a pipeline ask before it acts
A preflight engine answers a deployment pipeline, release tool or operator before it deploys, rolls back, retires, trains, uses a model or vendor, or turns on a tool. The check is one HTTPS call from whatever your pipeline runs. The engine answers allowed, allowed with warnings or denied, with plain sentences naming the fix, and records each answer with the rules version that gave it.
- Run one engine per environment. A pipeline calls the engine for the environment it is acting in.
- The engine holds only the rules you published and deployed to it, and a question it holds no rules for is refused.
- If the hub cannot be reached, each question either refuses to answer or answers from cached facts no older than a limit you set.
Fleet
See every component and whether it is healthy
The Edge dashboard in Aicura shows every component you run, in every environment, with its health, version and what it holds. A component that has gone quiet is easy to spot.
Health, versions and rules in one list
Each component reads Online, Idle, Stale or Never connected, and a registered component that has never connected is shown as registered, not healthy. Security and drift engines read Idle between runs, because they only report when a run lands. Each gateway shows the rule versions it is enforcing and the scanners it can run.
Registering a component issues a credential shown once, and the component switches itself on the first time it connects. Rotate a credential at any time. Suspend a component to stop it without losing its history, or remove it to revoke its credential. Neither deletes the record of what it did.
Questions
Does AI traffic pass through Aicura?
No. Your applications and agents call the AI gateway in your own network, and the gateway calls the model provider directly. Aicura is never in the request path. It receives the gateway's enforcement events and summarised usage figures through your hub, and prompts, responses and provider credentials stay in your network.
Can we use our own AI gateway with Aicura?
Yes. Kong, Envoy with OPA, LiteLLM, or any gateway that can send JSON can be registered as your own gateway. It sends its logs to your hub, and refused requests land in Aicura as blocks. Each published guardrail version can be exported as a signed bundle in Rego for OPA, as a Bedrock Guardrails configuration or as generic JSON, and your gateway pulls it.
Does Aicura support OpenTelemetry?
Yes. Aicura's collector is an OpenTelemetry Collector that receives standard OTLP traces over HTTP or gRPC. It keeps only generative AI spans, following the OpenTelemetry GenAI semantic conventions and accepting the older OpenLLMetry attribute names, and removes prompt and response content inside your network. Only per-minute counts, tokens and durations reach Aicura.
Do we need to open inbound firewall ports for Aicura?
No. The hub makes the only connection to Aicura, and it is outbound. Gateways, collectors and engines talk to the hub inside your network, and they collect new rules and settings by asking for them. Aicura never connects into your network.
What happens to the AI gateway if Aicura cannot be reached?
The gateway keeps enforcing the last signed rules it verified, which it holds on its own disk, and budget counts survive a restart. Security and drift engines keep their own schedules and keep running. Each preflight question has its own setting for an outage, either refusing to answer or answering from cached facts no older than a limit you set.
Put the gateway in front of your AI traffic
Contact us about where your AI traffic runs today and which components you want in your network first.