Enterprise LLM + MCP Gateway
The control plane for your organization’s AI traffic.
SecuriX sits in front of every LLM and MCP server your teams touch — enforcing SSO, budgets, virtual keys, and DLP policy before a token leaves your network. Runs on-prem or in your own VPC with Docker.
Virtual keys
128 / 6 teams
DLP this month
214 redactions
Access control
Single sign-on, enforced at the gateway.
Connect Okta, Azure AD, or any SAML/OIDC provider. Every request is tied to a real identity — no shared API keys floating around in Slack.
- SAML 2.0 & OIDC
- SCIM provisioning
- Role-based access per team
Cost control
Set a budget. Never blow through it by accident.
Cap spend per user, team, or project. SecuriX downgrades or blocks requests automatically when a limit is hit — before the invoice surprises anyone.
- Per-team and per-project caps
- Automatic model downgrade at threshold
- Real-time spend alerts
Credential hygiene
Generate keys your real provider credentials never touch.
Every team, app, or environment gets its own scoped virtual key — rotate or revoke instantly without touching the underlying OpenAI, Anthropic, or Azure credentials.
- Scoped to model, rate, and team
- Instant revoke, no redeploy
- Full usage attribution per key
Data protection
Catch sensitive data before it leaves your network.
SecuriX inspects prompts and completions for PII, secrets, and policy violations in real time — redact, block, or just log, per policy.
- Built-in PII & secret detectors
- Redact, block, or log per policy
- Full audit trail per request
Redacted SSN pattern in prompt · checkout-bot
Redacted AWS access key in completion · sales-copilot
Blocked customer record export · support-bot
Tool governance
Granular policy on every MCP tool call — not just the prompt.
SecuriX runs as the MCP gateway between your users and your MCP servers, plus a growing set of first-party integrations — so every tool call passes through policy, not just the prompt. Conditions on the request itself — who's asking, what they're touching, what it's worth — decide whether it runs.
- Gateway for any MCP server, not just first-party
- Attribute-based conditions, not just per-team access
- Allow, block, or require approval per action
Governed RAG
Ask your company's docs — but only the ones you're allowed to see.
Upload documents and SecuriX indexes them for retrieval-augmented answers. Scope a doc to a team — Finance, say — and only that team's questions ever surface its chunks, no matter who else asks.
- Per-team and per-user document scoping
- Access enforced in the retrieval index, not the UI
- Same identity, same permissions as everywhere else
“What was our Q3 burn rate?”
“What was our Q3 burn rate?”
Deployment
Runs on-prem or in your VPC. Never ours.
Deploy SecuriX in your data center or your own cloud account with a single docker run. Prompts, responses, and audit logs stay inside your boundary — we never host your traffic.
- One Docker image, on-prem or VPC
- Your data never touches our servers
- Hosted sandbox available for demos and POCs
- docker run securix/gateway
- Your data center
- Same admin console
- AWS, Azure, or GCP
- Your cloud account
- Same admin console
The DLP layer
Three actions. Your real data never leaves your infrastructure.
Every prompt and completion passes through SecuriX’s detectors for PII and secrets. Each policy decides what happens next.
Flag it, let it through.
The prompt reaches the model unchanged. SecuriX records what it found, who sent it, and where — so you can see exposure before you enforce anything.
Summarise the dispute for Emily Carter, card ending 4421.
flagged · 2 findings · sent as-isSwap it, restore it.
Real values are replaced with realistic synthetic ones before the request leaves. The model still gets a coherent prompt — just not your data.
Summarise the dispute for Laura Bennett, card ending 8830.
redacted · 2 values swappedStop it at the gateway.
The request never reaches the provider. The user gets a clear policy message instead of a completion, and the attempt is logged.
Export every customer record with SSN for the audit.
blocked · policy: no-bulk-pii- 01Your userSends a prompt
Email Emily Carter at emily@acme.com about her refund.
- 02SecuriXSwaps real for synthetic
Emily Carter → Laura Bennettemily@acme.com → laura@example.net
- 03Model providerOnly ever sees fakes
Hi Laura, your refund is on its way. Reply to laura@example.net with any questions.
- 04SecuriX → your userRestores the originals
Hi Emily, your refund is on its way. Reply to emily@acme.com with any questions.
How it works
From SSO to your first governed request in under a day.
Connect identity & providers
Point SecuriX at your Identity Provider for SSO (Okta, Azure AD, or any SAML/OIDC provider) and the model or MCP providers your teams already use. No client-side code changes.
Define policy
Set budgets, virtual keys, DLP rules, and attribute-based MCP tool policy — per team, per user, or per request attribute. As granular as your org needs.
Route through the gateway
Point client apps at your SecuriX endpoint instead of the provider directly. Deploy on-prem or in your VPC with a single docker run.
Monitor & audit
Every request, tool call, and knowledge-base query lands in one console — spend, redactions, and policy decisions, all attributable to a real identity.
See SecuriX in front of your own traffic.
Tell us where to reach you and we'll set up a walkthrough with your identity provider, your policies, and your budget structure.