AI scales. Compliance must not be the bottleneck.
Between your app and the model: rules, checks on sensitive data, and a clear record per request — in the traffic path, not a bolt-on tool.
Solid defaults you can refine — not a blank rulebook from scratch. Keep your SDK; checks and logs run with every call, without rebuilding your app.
Delta GatewayYour Application
OpenAI-compatible API · Chat-ready
const openai = new OpenAI({ baseURL: "https://rundelta.dev/v1", }); await openai.chat.completions.create({ model: "gpt-4o-mini", });
Compliance pipeline
Any model
routes to best provider
Ministral · Qwen · DeepSeek · BYO — fully extensible
What this marketing site collects is described in our privacy policy. Product logging and retention are agreed with you during rollout. Privacy policy
Deployment: SaaS processing in Frankfurt, Germany; additional regions, isolated environments, or self-hosted by arrangement.
Audit trail: policy outcomes and routing are traceable and exportable per request — less manual stitching for reviews.
API keys and roles: scoped access to models and policies, smaller blast radius than one key for everything.
`DELTA_API_KEY` stays in your runtime secret store — rotate and lifecycle it like any production credential.
Delta enforces policy checks, redacts PII, classifies risk, routes to the best model, and returns a signed audit record.
Plays once when this section scrolls into view — pick another scenario or replay the animation.
People still want modern AI at work, but legal and security need enforceable controls and clear accountability.
Security
We help you enforce policy, reduce sensitive-data leakage on the LLM path, and produce review-friendly evidence (receipts, routing and policy decisions). We do not replace endpoint security, IAM design, or secure application coding — your teams still own identity, device posture, and what the app sends to the gateway.
Every module maps to real dashboard surfaces — defense-in-depth from DLP/PEP to tamper-evident audit trails. Baseline policies and curated rule sets ship pre-configured: ready to use instead of months of rule bootstrap.
E2E observability and tracing on LLM traffic: every call gets a chain of custody — which policy fired, what was redacted under DLP-style rules, which routing decision applied. Faster SOC triage, less blind spot between app, gateway, and provider.
Policy enforcement point in front of the model provider: allow/deny and default-deny profiles, DLP/PII inspection, IPS-style blocking before egress. RBAC-aware, shrinking attack surface and blast radius before data leaves your perimeter to the LLM.
Risk class, review state, and conformity are managed in one place. This turns scattered compliance tasks into a clear and auditable approval flow.
Audit-ready evidence is available immediately and exportable on demand. Your team spends far less time assembling proof for internal or external reviews.
Access control and spend visibility are centralized instead of spread across provider consoles. Budget drift is visible early, before month-end surprises.
Use your own model-provider credentials (BYOK) or operated pool keys — aligned with procurement and crypto policy, without extra secret paths in your app.
Non-developers get chat access on the same platform: approved models with the same policies, PII protection, and auditing as API traffic. Business teams chat in an enterprise-compliant way — without drifting outside your governance perimeter.
In an emergency, quickly cut off traffic to an LLM provider or reroute it through the gateway — without touching every service by hand. Notifications make sure ops and owners can act immediately.
Developer access, model approvals, and policy changes are documented transparently. This reduces coordination overhead and keeps decisions traceable later.
Requests are automatically routed to cost- and quality-optimized models. You reduce recurring model spend without defaulting to one-size-fits-all quality tradeoffs.
Production-ready with pre-built baselines: less busywork, clearer ownership. Each core feature is meant to save time, surface risk, and spare security and compliance teams from audit and approval grind.
Typical setup without a gateway
With a gateway in production
OpenAI-compatible API — point your client at the gateway (`https://rundelta.dev/v1`) instead of the provider base URL. Keep your SDK, calls, and model strings; policies and audit run automatically on that path.
Security integration checklist (no extra code paths): keep `DELTA_API_KEY` in a secret store your platform already uses; rotate like any production credential. mTLS, private connectivity, and key-management integrations are part of enterprise deployment discussions — we align to your network and KMS standards rather than forcing a one-size pattern.
import OpenAI from "openai";
// Drop-in: only the base URL points at the gateway
const client = new OpenAI({
apiKey: process.env.DELTA_API_KEY,
baseURL: "https://rundelta.dev/v1",
});
const out = await client.chat.completions.create({
model: "gpt-4o-mini",
messages: [{ role: "user", content: "Summarize this contract" }],
});
A short split of responsibilities — what the gateway is built to mitigate versus what stays in your app and org policies.
Prompt injection & jailbreak attempts
Inline enforcement, allow/deny profiles, and DLP-style inspection can block or redact many egress attempts before they reach the provider.
Application trust boundaries, tool permissions, and human-in-the-loop for high-risk actions remain your design choices.
Data exfiltration via the model channel
Policy hits, redaction, and routing decisions are recorded for triage; Flow Explorer gives chain-of-custody per call.
Classification of what may leave the perimeter and business rules for attachments/context are still owned by you.
Tool / agent misuse
Traffic passes through the same policy and logging path; kill switch and quotas limit blast radius when something misbehaves.
Orchestration logic, tool schemas, and approval workflows for autonomous actions stay in your stack.
Flow Explorer — E2E observability and request tracing: policy hits, redaction, routing; chain of custody per LLM call.
We record what happened for each request; your SOC uses it to triage incidents without stitching logs from app, gateway, and provider by hand.
Observability here means structured telemetry and trace IDs tied to policy outcomes — not a generic dashboard.
LLM firewall (inline PEP) — default-deny/allow, DLP/PII inspection, IPS-style blocking before traffic reaches the provider.
The gateway enforces the rules you configure (allowlists, redaction, blocks); you still decide policy content and exceptions.
PEP (policy enforcement point) is the control choke-point on the wire. DLP-style means pattern- and rule-based content controls, not a separate enterprise DLP SKU.
EU AI Act hub + audit trail — risk and review workflow with exportable evidence for internal and external questions.
Helps you document model traffic and decisions for oversight; final legal classification remains yours with counsel.
“Ready” means technical artifacts and workflows — not a certification that a regulator pre-approved your use case.
Cost optimization + kill switch — central spend, quotas, and emergency cut-off or reroute of LLM egress.
Operators get one place to cap usage or stop traffic when something looks wrong; routing rules stay versioned like other policies.
Kill switch is an operational control for LLM paths through the gateway, not full network segmentation by itself.
Book a demo for your compliance and engineering leads and see the full process flow live.
Built and operated in
Wiesbaden
Integration, governance, and next steps.