Does Portkey's SaaS control plane see my prompts and keys?

In Portkey's hybrid model the gateway can run in your network, but the control plane remains SaaS — metadata, usage, and configuration flow through Portkey. GateLLM is fully self-hosted: prompts, completions, and keys never leave your perimeter.

How does pricing actually compare?

Different models. Portkey charges $49/mo plus $9 per 100k recorded logs — the observability cost grows with traffic. GateLLM is a flat $400/mo license (Pro 2GB), decoupled from volume. Pick by whether you want a usage-based SaaS or a fixed self-hosted license.

Does GateLLM have Portkey's guardrails and prompt management?

No — and we say so plainly. GateLLM does not ship a 60+ guardrail library or a prompt studio; those are Portkey's genuine strengths. If guardrails and prompt lifecycle are the deciding factor, Portkey wins that category.

Was Portkey really acquired by Palo Alto Networks?

Yes. Palo Alto Networks announced the acquisition on 2026-04-30 and completed it on 2026-05-29; Portkey is now positioned as the Prisma AIRS AI Gateway, and its alternatives and solutions pages redirect to paloaltonetworks.com.

GateLLM vs Portkey (Prisma AIRS)

A source-verified comparison. Portkey is a mature SaaS AI gateway with guardrails, prompt management, and observability — acquired by Palo Alto Networks on 2026-05-29 and now folded into Prisma AIRS. GateLLM is a fully self-hosted gateway with a flat capacity license. The differences are the control plane, the data path, and how the price scales.

Only GateLLM does this

Where we differ in kind, not just in degree. Portkey is strong on guardrails and prompt management — those appear in the honest-limits section below, not here.

Capability	GateLLM	Portkey
Fully self-hosted with no SaaS control planeGateLLM is a single Rust binary you run in your own VPC — prompts, completions, and keys never leave your perimeter. Portkey is hybrid: the gateway can run in your network, but the control plane remains SaaS.	Yes	No
Flat capacity license (price never scales with traffic)Pro is $400/mo for a 2GB instance, fixed. Portkey's Production tier is $49/mo plus $9 per 100k recorded logs — observability costs grow with volume.	Yes	No
Native multi-protocol entrypoints (4 ingress × 4 egress, any-to-any)OpenAI / Anthropic / Gemini / DashScope translate any-to-any, plus 15 upstream shapes. Portkey speaks an OpenAI-compatible surface; non-OpenAI SDKs go through compatibility shims.	Yes	No
Plan-mode model switching (top-tier plan / open SOTA execute)Declarative switch-route rules + built-in plan-mode detection + useModel scripts — the ~90% cost lever Portkey does not have.	Yes	No
Microsoft 365 add-in (Excel / Word / PPT / Outlook)Self-hosted, wired to your own gateway. Portkey has no Office add-in.	Yes	No

Both do these well

A settled baseline — either gateway covers this layer. The decision lives in the layers above and below.

Capability	GateLLM	Portkey
Multi-model routing & fallback	Yes	Yes
Load balancing & retries	Yes	Yes
Rate limiting & quotas	Yes	Yes
Key management (virtual keys)	Yes	Yes
Caching (simple & semantic)	Yes	Yes
MCP tool governance	Yes	Yes
Observability (logs, traces, cost)	Yes	Yes
SSO / RBAC / SCIM	Yes	Yes

Different in kind

Not better or worse — different deployment, pricing, and focus you should weigh directly.

Capability	GateLLM	Portkey
Deployment	Fully self-hosted — single binary in your VPC	Hybrid — gateway in your network, control plane SaaS
Pricing	Flat per-instance license (Pro 2GB $400/mo)	$49/mo + $9 per 100k recorded logs (usage-based)
Guardrails	Client admission + governance; no built-in guardrail library	60+ built-in guardrails, PII redaction, jailbreak detection
Prompt management	Not offered — you own prompts, we own the routing plane	Prompt studio: templates, versioning, environment promotion
Runtime	Single Rust binary, no GC pauses	SaaS control plane + gateway agent
Vendor ownership	Independent product of Fluxon LLC	Acquired by Palo Alto Networks (2026-05-29), folded into Prisma AIRS

Verified 2026-09-09 against portkey.ai and paloaltonetworks.com. Features and pricing drift — check the sources before procurement.

Where the edge actually lives

How the differentiators work

Each GateLLM differentiator is a mechanism, not a marketing line. Here is what it does under the hood, and what Portkey does instead.

Fully self-hosted, no SaaS control plane

GateLLM: A single Rust binary you run in your own VPC — prompts, completions, and keys never leave your perimeter. There is no hosted component to see your metadata.

Where Portkey falls short: Hybrid: the gateway can run in your network, but the control plane, metadata, and configuration remain SaaS.

Native multi-protocol entrypoints

GateLLM: Four native ingresses (OpenAI / Anthropic / Gemini / DashScope) translate any-to-any, plus 15 upstream shapes — one gateway serves every SDK natively.

Where Portkey falls short: OpenAI-compatible surface; non-OpenAI SDKs go through compatibility shims and cross-vendor format drift.

Plan-mode model switching

GateLLM: Declarative switch-route rules + built-in plan-mode detection + useModel scripts — planning on top-tier models, execution on open SOTA, zero client change.

Where Portkey falls short: No plan-mode awareness; routing and semantic decisions live in the SaaS control plane, without a planning/execution tier split.

Flat license, price never scales with traffic

GateLLM: Pro is $400/mo for a 2GB instance, fixed. Double your tokens and the license does not move.

Where Portkey falls short: $49/mo plus $9 per 100k recorded logs — observability cost grows with every request.

Microsoft 365 add-in

GateLLM: A self-hosted Office add-in covering Excel / Word / PowerPoint / Outlook, wired to your own gateway with Entra SSO and Purview label gating — data never leaves your network.

Where Portkey falls short: No Office add-in; Portkey has no equivalent for calling models from inside Microsoft 365.

Migrating from Portkey

Point your SDK base_url at GateLLM — no other code changes. Your BYOK keys and routing policies carry over; your prompt templates and guardrails do not (see the honest-limits FAQ).

1Point your OpenAI SDK base_url at GateLLM (with /v1) — one line, no other code changes.
2Enter your provider keys into the console (BYOK) — they live in gateway memory, never persisted.
3Recreate your routing / fallback / load-balancing policies in the console — they carry over 1:1.
4Re-implement guardrails and prompt templates outside the gateway, or evaluate whether you still need them once traffic is self-hosted.

Flat license vs usage-priced SaaS

GateLLM is a flat per-instance license — Pro 2GB $400/mo, fixed regardless of volume. Portkey's Production tier is $49/mo plus $9 per 100k recorded logs, so its cost grows with your traffic.

Cost structure

•GateLLM: flat per-instance license (Pro 2GB $400/mo) — no seats, no token markup, no per-log fees.
•Portkey: $49/mo Production plus $9 per 100k recorded logs; Enterprise is custom-quoted.
•At high volume the flat license decouples cost from usage; Portkey's observability bill scales with traffic.

When to choose which

Choose Portkey (Prisma AIRS) if…

You need a turnkey SaaS control plane, 60+ built-in guardrails, a prompt management studio, and PII redaction out of the box — and you are already in the Palo Alto Networks ecosystem.

Choose GateLLM if…

You need prompts and keys to never leave your perimeter, a flat license that stays fixed as usage grows, native multi-protocol entrypoints, or plan-mode switching for ~90% cost reduction.

Watch the ownership risk

Portkey was acquired by Palo Alto Networks on 2026-05-29 and folded into Prisma AIRS; its alternatives and solutions pages now 301 to paloaltonetworks.com. If vendor independence matters, GateLLM is independently owned.

FAQ