Portkey Security & Compliance
SOC 2 certified infrastructure, virtual key management, PII protection, full audit trails, and enterprise access controls enforced at the gateway layer

SOC 2 Type II Certification

Portkey's managed cloud is SOC 2 Type II certified with annual third-party audits. For organisations that require it, a self-hosted deployment option is available for air-gapped and highly regulated environments where no data can leave the organisation's own infrastructure.

• SOC 2 Type II certified managed cloud.
• Annual third-party security audits.
• Self-hosted option for air-gapped environments.
• GDPR compliant with zero data retention (ZDR) option.

Virtual Key Management

Store raw LLM provider API keys in Portkey's encrypted vault and issue scoped virtual keys to individual teams, applications, and environments. Rotate or revoke access at any time without touching application code, and review the full usage audit log per key.

• Encrypted vault for all provider credentials.
• Scoped virtual keys per team, service, or environment.
• Instant rotation and revocation without code changes.
• Full usage audit log per virtual key.

PII Detection & Redaction

Automatically detect and redact personally identifiable information – names, email addresses, credit card numbers, and more – before prompts reach external LLM providers and before responses reach end users. Designed to support GDPR and data minimisation requirements.

• 20+ PII entity types supported.
• Scanning on both prompt input and model response output.
• Auto-redaction or hard block on detection.
• Full event log per triggered rule.

Full Audit Trail

Every request and response is logged with user ID, timestamp, model used, token counts, and cost. Logs are exportable in structured formats for compliance reviews, security investigations, and legal audits, with configurable retention policies per environment.

• Full request and response log with 40+ metadata fields.
• User ID, timestamp, model, tokens, and cost per entry.
• Exportable for compliance, security, and legal requirements.
• Configurable retention policy per environment.

Budget & Rate Limit Enforcement

Set hard and soft spend limits per team, project, or virtual key at the gateway layer. Real-time cost tracking and overage alerts prevent runaway AI costs before they become a problem, with rate limiting applied per key to manage provider capacity.

• Hard and soft spend limits per team and project.
• Per-virtual-key rate limiting (requests per minute and tokens per minute).
• Real-time cost tracking with overage alerts.
• Alerts via dashboard, email, or webhook.

Self-Hosted Deployment

Deploy the open-source Portkey gateway on your own infrastructure for complete data sovereignty. No request or response data egresses to Portkey servers. Self-hosted deployments support Kubernetes, Docker, and private VPC configurations, and are fully auditable as open-source software.

• Full data sovereignty – no egress to Portkey servers.
• Kubernetes, Docker, and private VPC support.
• Open-source and fully auditable codebase.
• Active/active cluster configuration for high availability.

Enterprise Access Controls

Manage user access to the Portkey dashboard and prompt library with role-based access control. SSO and SAML integration are available on the Enterprise tier, enabling centralised identity management through your existing identity provider.

• Role-based access control per team and project.
• SSO and SAML support on Enterprise tier.
• Centralised identity provider integration.
• Per-virtual-key permission scoping.

Zero Data Retention (ZDR)

For organisations with strict data handling requirements, Portkey's zero data retention option ensures that no prompt or response content is stored on Portkey infrastructure. All gateway functionality – routing, caching, retries, and observability metadata – continues to operate with ZDR enabled.

Compliance and Observability Integration

Native integrations with Datadog, Grafana, and OpenTelemetry enable audit log data and security events to flow into your existing monitoring and compliance tooling. Every guardrail trigger, blocked request, and budget overage is available as a structured event for downstream processing.

• Native Datadog, Grafana, and OpenTelemetry integrations.
• Structured security event export for SIEM tools.
• Guardrail trigger and budget overage events available via webhook.
• Full observability metadata without storing prompt content under ZDR.

Portkey Security & Compliance Specifications: