# GateLLM vs Portkey - Self-Hosted BYOK Alternative

> GateLLM vs Portkey (Prisma AIRS): fully self-hosted BYOK gateway vs usage-priced SaaS AI gateway. Control plane, data path, pricing, and the Palo Alto Networks acquisition compared.

Canonical: https://www.gatellm.io/compare/portkey/

## GateLLM vs Portkey (Prisma AIRS)
A source-verified comparison. Portkey is a mature SaaS AI gateway with guardrails, prompt management, and observability — acquired by Palo Alto Networks on 2026-05-29 and now folded into Prisma AIRS. GateLLM is a fully self-hosted gateway with a flat capacity license. The differences are the control plane, the data path, and how the price scales.
## Migrating from Portkey
Point your SDK base_url at GateLLM — no other code changes. Your BYOK keys and routing policies carry over; your prompt templates and guardrails do not (see the honest-limits FAQ).
- Point your OpenAI SDK base_url at GateLLM (with /v1) — one line, no other code changes.
- Enter your provider keys into the console (BYOK) — they live in gateway memory, never persisted.
- Recreate your routing / fallback / load-balancing policies in the console — they carry over 1:1.
- Recreate prompt templates outside the gateway, and re-point any guardrails you relied on — GateLLM covers deterministic secret & PII rules on the request path, not model-based prompt checks.

## Flat license vs usage-priced SaaS
GateLLM is a flat per-instance license — Pro 2GB $400/mo, fixed regardless of volume. Portkey's Production tier is $49/mo plus $9 per 100k recorded logs, so its cost grows with your traffic.
## Cost structure
- GateLLM: flat per-instance license (Pro 2GB $400/mo) — no seats, no token markup, no per-log fees.
- Portkey: $49/mo Production plus $9 per 100k recorded logs; Enterprise is custom-quoted.
- At high volume the flat license decouples cost from usage; Portkey's observability bill scales with traffic.

## When to choose which
### Choose Portkey (Prisma AIRS) if…
You need a turnkey SaaS control plane, a 60+ guardrail library with jailbreak detection, and a prompt management studio — and you are already in the Palo Alto Networks ecosystem.
### Choose GateLLM if…
You need prompts and keys to never leave your perimeter, a flat license that stays fixed as usage grows, native multi-protocol entrypoints, or plan-mode switching for ~90% cost reduction.
### Watch the ownership risk
Portkey was acquired by Palo Alto Networks on 2026-05-29 and folded into Prisma AIRS; its alternatives and solutions pages now 301 to paloaltonetworks.com. If vendor independence matters, GateLLM is independently owned.
## FAQ
### Does Portkey's SaaS control plane see my prompts and keys?
In Portkey's hybrid model the gateway can run in your network, but the control plane remains SaaS — metadata, usage, and configuration flow through Portkey. GateLLM is fully self-hosted: prompts, completions, and keys never leave your perimeter.
### How does pricing actually compare?
Different models. Portkey charges $49/mo plus $9 per 100k recorded logs — the observability cost grows with traffic. GateLLM is a flat $400/mo license (Pro 2GB), decoupled from volume. Pick by whether you want a usage-based SaaS or a fixed self-hosted license.
### Does GateLLM have Portkey's guardrails and prompt management?
Partly, and we say plainly where not. GateLLM ships deterministic secret & PII rules on the request path (log / mask / block), but no 60+ guardrail library, no jailbreak or prompt-injection detection, and no prompt studio. If jailbreak detection or prompt lifecycle is the deciding factor, Portkey wins that category.
### Was Portkey really acquired by Palo Alto Networks?
Yes. Palo Alto Networks announced the acquisition on 2026-04-30 and completed it on 2026-05-29; Portkey is now positioned as the Prisma AIRS AI Gateway, and its alternatives and solutions pages redirect to paloaltonetworks.com.
Verified 2026-09-09 against portkey.ai and paloaltonetworks.com. Features and pricing drift — check the sources before procurement.
### How the differentiators work
Each GateLLM differentiator is a mechanism, not a marketing line. Here is what it does under the hood, and what Portkey does instead.
#### Fully self-hosted, no SaaS control plane
- **GateLLM**: A single Rust binary you run in your own VPC — prompts, completions, and keys never leave your perimeter. There is no hosted component to see your metadata.
- **Where Portkey falls short**: Hybrid: the gateway can run in your network, but the control plane, metadata, and configuration remain SaaS.

#### Native multi-protocol entrypoints
- **GateLLM**: Four native ingresses (OpenAI / Anthropic / Gemini / DashScope) translate any-to-any, plus 15 upstream shapes — one gateway serves every SDK natively.
- **Where Portkey falls short**: OpenAI-compatible surface; non-OpenAI SDKs go through compatibility shims and cross-vendor format drift.

#### Plan-mode model switching
- **GateLLM**: Declarative switch-route rules + built-in plan-mode detection + useModel scripts — planning on top-tier models, execution on open SOTA, zero client change.
- **Where Portkey falls short**: No plan-mode awareness; routing and semantic decisions live in the SaaS control plane, without a planning/execution tier split.

#### Flat license, price never scales with traffic
- **GateLLM**: Pro is $400/mo for a 2GB instance, fixed. Double your tokens and the license does not move.
- **Where Portkey falls short**: $49/mo plus $9 per 100k recorded logs — observability cost grows with every request.

#### Microsoft 365 add-in
- **GateLLM**: A self-hosted Office add-in covering Excel / Word / PowerPoint / Outlook, wired to your own gateway with Entra SSO and Purview label gating — data never leaves your network.
- **Where Portkey falls short**: No Office add-in; Portkey has no equivalent for calling models from inside Microsoft 365.

## Comparison table
### Only GateLLM does this
Where we differ in kind, not just in degree. Portkey is strong on guardrails and prompt management — those appear in the honest-limits section below, not here.
| Capability | GateLLM | Portkey |
| --- | --- | --- |
| Fully self-hosted with no SaaS control plane | ✓ | ✗ |
| Flat capacity license (price never scales with traffic) | ✓ | ✗ |
| Native multi-protocol entrypoints (4 ingress × 4 egress, any-to-any) | ✓ | ✗ |
| Plan-mode model switching (top-tier plan / open SOTA execute) | ✓ | ✗ |
| Microsoft 365 add-in (Excel / Word / PPT / Outlook) | ✓ | ✗ |

- **Fully self-hosted with no SaaS control plane**: GateLLM is a single Rust binary you run in your own VPC — prompts, completions, and keys never leave your perimeter. Portkey is hybrid: the gateway can run in your network, but the control plane remains SaaS.
- **Flat capacity license (price never scales with traffic)**: Pro is $400/mo for a 2GB instance, fixed. Portkey's Production tier is $49/mo plus $9 per 100k recorded logs — observability costs grow with volume.
- **Native multi-protocol entrypoints (4 ingress × 4 egress, any-to-any)**: OpenAI / Anthropic / Gemini / DashScope translate any-to-any, plus 15 upstream shapes. Portkey speaks an OpenAI-compatible surface; non-OpenAI SDKs go through compatibility shims.
- **Plan-mode model switching (top-tier plan / open SOTA execute)**: Declarative switch-route rules + built-in plan-mode detection + useModel scripts — the ~90% cost lever Portkey does not have.
- **Microsoft 365 add-in (Excel / Word / PPT / Outlook)**: Self-hosted, wired to your own gateway. Portkey has no Office add-in.

### Both do these well
A settled baseline — either gateway covers this layer. The decision lives in the layers above and below.
| Capability | GateLLM | Portkey |
| --- | --- | --- |
| Multi-model routing & fallback | ✓ | ✓ |
| Load balancing & retries | ✓ | ✓ |
| Rate limiting & quotas | ✓ | ✓ |
| Key management (virtual keys) | ✓ | ✓ |
| Caching (simple & semantic) | ✓ | ✓ |
| MCP tool governance | ✓ | ✓ |
| Observability (logs, traces, cost) | ✓ | ✓ |
| SSO / RBAC / SCIM | ✓ | ✓ |

### Different in kind
Not better or worse — different deployment, pricing, and focus you should weigh directly.
| Capability | GateLLM | Portkey |
| --- | --- | --- |
| Deployment | Fully self-hosted — single binary in your VPC | Hybrid — gateway in your network, control plane SaaS |
| Pricing | Flat per-instance license (Pro 2GB $400/mo) | $49/mo + $9 per 100k recorded logs (usage-based) |
| Guardrails | Client admission + governance; deterministic secret & PII rules on the request path (log / mask / block, per scope). No guardrail library, no jailbreak or prompt-injection detection | 60+ built-in guardrails, PII redaction, jailbreak detection |
| Prompt management | Not offered — you own prompts, we own the routing plane | Prompt studio: templates, versioning, environment promotion |
| Runtime | Single Rust binary, no GC pauses | SaaS control plane + gateway agent |
| Vendor ownership | Independent product of Fluxon LLC | Acquired by Palo Alto Networks (2026-05-29), folded into Prisma AIRS |

## Other comparisons
- [LiteLLM](https://www.gatellm.io/compare/litellm.md)
- [OpenRouter](https://www.gatellm.io/compare/openrouter.md)
- [Alibaba Cloud AI Gateway](https://www.gatellm.io/compare/alibaba-cloud.md)
- [Azure API Management](https://www.gatellm.io/compare/azure-apim.md)
- [Apigee](https://www.gatellm.io/compare/apigee.md)
- [Cloudflare AI Gateway](https://www.gatellm.io/compare/cloudflare.md)
- [Kong AI Gateway](https://www.gatellm.io/compare/kong.md)

## Related
- [Home](https://www.gatellm.io/index.md)
- [Pricing](https://www.gatellm.io/pricing.md)
- [Cost Calculator](https://www.gatellm.io/calculator.md)
- [About](https://www.gatellm.io/about.md)
- [Book a Demo](https://www.gatellm.io/demo.md)
- [FAQ](https://www.gatellm.io/faq.md)
- [Compare AI Gateways](https://www.gatellm.io/compare.md)
- [Compare LiteLLM](https://www.gatellm.io/compare/litellm.md)
- [Compare OpenRouter](https://www.gatellm.io/compare/openrouter.md)
- [Compare Alibaba Cloud AI Gateway](https://www.gatellm.io/compare/alibaba-cloud.md)
- [Compare Azure API Management](https://www.gatellm.io/compare/azure-apim.md)
- [Compare Apigee](https://www.gatellm.io/compare/apigee.md)
- [Compare Cloudflare AI Gateway](https://www.gatellm.io/compare/cloudflare.md)
- [Compare Kong AI Gateway](https://www.gatellm.io/compare/kong.md)
- [LiteLLM vs Kong AI Gateway](https://www.gatellm.io/compare/litellm-vs-kong.md)
- [LiteLLM vs OpenRouter](https://www.gatellm.io/compare/litellm-vs-openrouter.md)
- [LiteLLM vs Portkey](https://www.gatellm.io/compare/litellm-vs-portkey.md)
- [Use Cases](https://www.gatellm.io/use-cases.md)
- [Reduce LLM Cost](https://www.gatellm.io/use-cases/reduce-cost.md)
- [High Availability](https://www.gatellm.io/use-cases/high-availability.md)
- [Multi-Tenant Isolation](https://www.gatellm.io/use-cases/multi-tenant.md)
- [Compliance & Audit](https://www.gatellm.io/use-cases/compliance-audit.md)
- [Troubleshooting by Symptom](https://www.gatellm.io/use-cases/troubleshooting.md)
- [Mixed Multi-Vendor Model Stack](https://www.gatellm.io/use-cases/mixed-model-stack.md)
- [Self-Host AI Inside Office](https://www.gatellm.io/use-cases/self-hosted-office-ai.md)
- [Token Usage Visibility & Attribution](https://www.gatellm.io/use-cases/token-ops.md)
- [Token FinOps: AI Cost Allocation & Control](https://www.gatellm.io/use-cases/token-finops.md)
- [MCP Tool Governance](https://www.gatellm.io/use-cases/mcp-tool-governance.md)
- [Web Search for Every Model](https://www.gatellm.io/use-cases/web-search-grounding.md)
- [Multi-Key Rotation & Standby](https://www.gatellm.io/use-cases/multi-key-pooling.md)
- [Admission Control for Connected Clients](https://www.gatellm.io/use-cases/client-admission-control.md)
- [Enforce Which Model Agents Actually Run](https://www.gatellm.io/use-cases/enforce-model-policy.md)
- [No Model Choice on the Client](https://www.gatellm.io/use-cases/automatic-model-tiering.md)
- [One Protocol, Any Model](https://www.gatellm.io/use-cases/one-protocol-any-model.md)
- [Office / Microsoft 365 Add-in](https://www.gatellm.io/office-addin.md)
- [Glossary](https://www.gatellm.io/glossary.md)
- [Model Catalog](https://www.gatellm.io/models.md)
- [SDK & Framework Integrations](https://www.gatellm.io/integrations.md)
- [AI Coding Agents & Harnesses](https://www.gatellm.io/coding-agents.md)
- [Security & Compliance](https://www.gatellm.io/security.md)
- [Privacy Policy](https://www.gatellm.io/privacy-policy.md)
- [Terms of Service](https://www.gatellm.io/terms.md)
- [Cookie Policy](https://www.gatellm.io/cookies.md)
- [Data Processing Agreement (DPA)](https://www.gatellm.io/dpa.md)
- [Sub-processor List](https://www.gatellm.io/subprocessors.md)
- [Security Questionnaire (CAIQ/SIG/VSA)](https://www.gatellm.io/trust.md)
- [Incident Response & Support](https://www.gatellm.io/sla.md)
- [Vulnerability Disclosure Policy](https://www.gatellm.io/vulnerability-disclosure.md)
- [Open Source License Notice](https://www.gatellm.io/open-source-licenses.md)
- [Version Support & Lifecycle (EOL)](https://www.gatellm.io/lifecycle.md)
- [Engineering Blog](https://www.gatellm.io/blog.md)
- [Your Agents Have More Permissions Than Your Employees: Governing MCP Tools at the Gateway](https://www.gatellm.io/blog/mcp-tool-governance.md)
- [The $10k Invoice Problem: Five Ways to Cut LLM Spend Without Dumbing Down Your App](https://www.gatellm.io/blog/reduce-cost.md)
- [Your Vendor's List Price Is Not Your Cost: Applying Real FinOps to Token Spend](https://www.gatellm.io/blog/token-finops.md)
- [llms.txt](https://www.gatellm.io/llms.txt)