Built to sit in front of your most sensitive systems
Gatehouse holds the keys to your code, data and cloud accounts. This page explains how we protect them, and what you control.
Encryption
Server credentials and identity-provider secrets are encrypted at rest with AES-256-GCM. Self-hosted installs load the key from your KMS, Vault or a mounted secret, and production mode refuses to start without one.
Tokens
Only SHA-256 hashes of tokens are stored. Agent sign-ins use OAuth 2.1 with PKCE, expire hourly and rotate on refresh. Reusing an authorization code revokes what it issued.
Identity
Single sign-on with Google, GitHub, OIDC and SAML. Enforced two-step verification with recovery codes. SCIM provisioning, Active Directory and LDAP group sync, and instant deprovisioning.
Least privilege
New tools start off and unmatched calls are denied. Agents act with the person's permissions, and per-person credentials keep it that way for tools like GitHub.
Agent-specific threats
Secrets in arguments are blocked and secrets in results are redacted. Tool definitions are pinned and scanned for hidden instructions; changes pause the tool until reviewed.
Audit
Every call and admin change is written to an append-only log. Each entry includes a hash of the previous one, so tampering is detectable. Stream it to your SIEM as it happens.
Network controls
IP allow-lists for the console, API, MCP endpoint and SCIM. Strict content security policy, same-origin checks on forms, and sessions bound to the person who opened them.
Deployment choice
Use our cloud, or run Gatehouse in your own network with Docker or Kubernetes, without internet access.
Availability
If Gatehouse can't be reached, agents can't reach tools through it. That is the safe default for a security control; self-hosted deployments follow your own availability setup.
Compliance
Gatehouse gives you the controls and evidence auditors look for when AI agents touch production: access control, change approval, least privilege and a tamper-evident activity log. The audit log and approval records can be exported as evidence for SOC 2, ISO 27001 and EU AI Act record-keeping and human-oversight requirements.
Our own certifications are in progress. Contact us for our current security questionnaire answers.
Reporting a vulnerability
If you find a security issue, report it privately to your Gatehouse contact rather than in a public issue, with steps to reproduce. Self-hosted customers should also follow their own incident process.