Skip to content
Noviqent.

Security & trust

Know exactly where your keys and prompts go.

Airelay sits between your applications and the providers, agents and APIs they call. Here's how we handle what passes through — stated plainly, without claims we can't back up.

Provider keys: yours, and kept out of the engine

Airelay is bring-your-own-key. Each provider bills your own account; we never pool your traffic onto a shared key or resell tokens.

Two ways to store a key

Encrypted at rest in Airelay's database, or kept in your organisation's own Noviqent Vault space — provisioned automatically at signup — and resolved only at the moment a request needs it.

Injected per request

Your key is added to each outbound request by the Airelay backend rather than stored in the gateway engine's configuration — Google included, whose Gemini and Vertex models are reached with an API key like every other provider. The one exception is AWS Bedrock, whose request signing can't be supplied per request: its access key pair is held in the gateway's internal configuration, on an internal-only network.

Write-only in the dashboard

Once saved, a provider key is never shown again. Secrets referenced from your Vault show as a reference, not a value.

Tenant isolation

Every organisation's gateway configuration is tagged and scoped to that organisation, and enforced on every request.

  • Your routes live under your own path (/gw/<your-org>/) and can't claim another organisation's paths or hostnames.
  • A consumer credential from one organisation is rejected on another organisation's routes, even if it's otherwise valid.
  • Plugins you configure can only attach to your own services, routes and consumers — never globally.
  • URLs and hosts you configure are checked so they can't point the gateway at internal or private network addresses.
  • The gateway's own admin interface is on an internal network only and never exposed publicly.

Your data in flight

Prompts pass through Airelay on their way to the provider you chose, with your own key.

Redact before it leaves

Turn on PII redaction and personal data — including UK identifiers like National Insurance and NHS numbers — is replaced before the prompt reaches any provider.

Guard both directions

Semantic prompt and response guards, plus your choice of third-party guardrail service, can block requests and responses you don't want.

Content storage is opt-in

Request metadata — model, tokens, latency, cost, status — powers your analytics and billing. The features that keep content, the semantic cache and RAG documents, are ones you switch on, and you can clear them at any time.

Team access and accountability

Invite your team with the least access they need, and see who changed what.

Role-based access

Owner, Admin, Developer, Viewer roles, assigned by invitation. Viewers can see, developers can change configuration, admins manage the team.

Audit log

Configuration changes across the AI gateway, API gateway and agent connections are recorded with who made them and when.

Account security

Optional TOTP two-factor authentication on every account, and strong passwords (12+ characters, mixed case, a number and a symbol) enforced server-side at registration.

Data residency

The gateway itself runs on Noviqent's UK-hosted infrastructure. Where your prompt goes next depends on the provider you route it to.

Region-pinnable providers

Azure OpenAI, AWS Bedrock, IBM watsonx.ai, Databricks, Alibaba Cloud Model Studio support EU/UK-region deployments — set the region on your connected key. The catalog labels their models EU / UK pinnable.

EU-based providers

Mistral AI and Scaleway are EU-hosted by default — a natural choice when you want a European provider end to end.

Everyone else, labelled honestly

Providers that don't offer region pinning on their direct API — including direct OpenAI, Anthropic and Google Gemini access — are labelled Global in the model catalog. Models you host yourself are labelled Self-hosted: they go wherever you run them.

Provider residency options change. Always confirm against the provider's own current documentation before relying on a region for compliance purposes.

Questions about security?

We're happy to walk through how Airelay handles your data before you connect anything. Email hello@noviqent.co.uk.

Get started freeRead the quickstart