AI Gateway Security and Compliance

AI Gateway gives you controls over where your data goes and what providers can do with it. You can route only to providers with verified zero data retention agreements, prevent providers from training on your prompts, and restrict which providers serve traffic for your team. These controls work the same way regardless of which model you use.

• Enforce data privacy: Route only to providers with verified ZDR agreements with Zero Data Retention
• Block training on prompts: Prevent providers from using your prompts for model training with Disallow Prompt Training
• Restrict providers: Limit which AI providers can serve requests across your team with the Provider Allowlist
• Restrict models: Control which AI models your team can use with the Model Allowlist

AI Gateway uses zero data retention by default. It permanently deletes your prompts and responses after requests complete. For applications with strict compliance requirements, you can also enforce ZDR at the provider level:

const result = await streamText({
  model: 'anthropic/claude-opus-5',
  prompt: 'Analyze this sensitive data...',
  providerOptions: {
    gateway: { zeroDataRetention: true },
  },
});

When zeroDataRetention is enabled, requests only route to providers with verified ZDR agreements. See the ZDR documentation for the list of compliant providers.

The provider allowlist lets team owners restrict which AI providers can serve requests through AI Gateway. A request only returns 403 when no allowed provider can serve it. The feature is opt-in and available on Pro and Enterprise plans.

A common reason to enable this is compliance: your team has reviewed a specific set of providers, and you want to guarantee that AI Gateway never routes to one you haven't approved.

See the Provider Allowlist docs for configuration and pricing.

• Enable ZDR for sensitive workloads
• Disallow prompt training for your data
• Restrict providers for compliance