# Compliance & Audit: Self-Hosted, Redaction, Logging, Retention

> AI gateway compliance: self-hosted data-in-network, request/response logging off by default, request-path secret & PII detection, egress-redacted log bodies, login/permission audit, retention and deletion. SOC 2 / ISO 27001 controls aligned (certification in preparation), GDPR ready.

Canonical: https://www.gatellm.io/use-cases/compliance-audit/

Request and response logging (off by default), deterministic secret & PII detection on the request path, log bodies redacted at every egress surface, login and permission audit, retention and deletion — data never leaves your network; SOC 2 controls aligned (certification in preparation), GDPR ready.

## What the community actually complains about
Zhihu and Reddit: "finance / healthcare / government data can't leave the country," "calling an LLM requires an algorithm filing," "how do I redact PII," "how do I keep audit logs."
A SaaS gateway routes requests through its own servers, so compliance audits are hard; relays add data-exfiltration and resale risk.

## How GateLLM does it
GateLLM deploys fully inside your network — data never leaves, satisfying data-export compliance. Request and response logs are off by default and exportable for audit; deterministic secret & PII detection runs on the request path, with log, mask (reversibly) or block per scope; stored log bodies are redacted at every egress surface and raw reveal is admin-only and audited; login and permission audit (SSO via OIDC / SAML 2.0); retention and deletion are configurable.
BYOK keys live in memory, never on disk. GDPR ready; SOC 2 Type II / ISO 27001 controls aligned (certification in preparation).

## 5 levers that actually land
- Request and response logging (off by default), exportable to audit systems, bodies redacted at every egress surface
- Deterministic secret & PII detection on the request path — log, mask (reversibly), or block, per scope
- Login and permission audit (SSO via OIDC / SAML 2.0)
- Configurable retention and deletion policy
- Fully self-hosted: data never leaves the network, keys in memory only

## FAQ
### How do I use LLMs when data can't leave the country?
Deploy fully inside your network — requests route through the gateway straight to vendor APIs, data never leaves; domestic models are supported.

### How do audit logs and PII redaction work?
Request and response logs are off by default and exportable. Secret & PII detection runs on the request path (log / mask / block, per scope); stored log bodies are redacted at every egress surface, with raw reveal admin-only and audited; login and permission audit; retention and deletion are configurable.

- [Full how-to: Compliance & audit (docs)](https://docs.gatellm.io/en/usecases/compliance-audit)

## Related
- [Home](https://www.gatellm.io/index.md)
- [Pricing](https://www.gatellm.io/pricing.md)
- [Cost Calculator](https://www.gatellm.io/calculator.md)
- [About](https://www.gatellm.io/about.md)
- [Book a Demo](https://www.gatellm.io/demo.md)
- [FAQ](https://www.gatellm.io/faq.md)
- [Compare AI Gateways](https://www.gatellm.io/compare.md)
- [Compare LiteLLM](https://www.gatellm.io/compare/litellm.md)
- [Compare OpenRouter](https://www.gatellm.io/compare/openrouter.md)
- [Compare Alibaba Cloud AI Gateway](https://www.gatellm.io/compare/alibaba-cloud.md)
- [Compare Azure API Management](https://www.gatellm.io/compare/azure-apim.md)
- [Compare Apigee](https://www.gatellm.io/compare/apigee.md)
- [Compare Cloudflare AI Gateway](https://www.gatellm.io/compare/cloudflare.md)
- [Compare Kong AI Gateway](https://www.gatellm.io/compare/kong.md)
- [Compare Portkey](https://www.gatellm.io/compare/portkey.md)
- [LiteLLM vs Kong AI Gateway](https://www.gatellm.io/compare/litellm-vs-kong.md)
- [LiteLLM vs OpenRouter](https://www.gatellm.io/compare/litellm-vs-openrouter.md)
- [LiteLLM vs Portkey](https://www.gatellm.io/compare/litellm-vs-portkey.md)
- [Use Cases](https://www.gatellm.io/use-cases.md)
- [Reduce LLM Cost](https://www.gatellm.io/use-cases/reduce-cost.md)
- [High Availability](https://www.gatellm.io/use-cases/high-availability.md)
- [Multi-Tenant Isolation](https://www.gatellm.io/use-cases/multi-tenant.md)
- [Troubleshooting by Symptom](https://www.gatellm.io/use-cases/troubleshooting.md)
- [Mixed Multi-Vendor Model Stack](https://www.gatellm.io/use-cases/mixed-model-stack.md)
- [Self-Host AI Inside Office](https://www.gatellm.io/use-cases/self-hosted-office-ai.md)
- [Token Usage Visibility & Attribution](https://www.gatellm.io/use-cases/token-ops.md)
- [Token FinOps: AI Cost Allocation & Control](https://www.gatellm.io/use-cases/token-finops.md)
- [MCP Tool Governance](https://www.gatellm.io/use-cases/mcp-tool-governance.md)
- [Web Search for Every Model](https://www.gatellm.io/use-cases/web-search-grounding.md)
- [Multi-Key Rotation & Standby](https://www.gatellm.io/use-cases/multi-key-pooling.md)
- [Admission Control for Connected Clients](https://www.gatellm.io/use-cases/client-admission-control.md)
- [Enforce Which Model Agents Actually Run](https://www.gatellm.io/use-cases/enforce-model-policy.md)
- [No Model Choice on the Client](https://www.gatellm.io/use-cases/automatic-model-tiering.md)
- [One Protocol, Any Model](https://www.gatellm.io/use-cases/one-protocol-any-model.md)
- [Office / Microsoft 365 Add-in](https://www.gatellm.io/office-addin.md)
- [Glossary](https://www.gatellm.io/glossary.md)
- [Model Catalog](https://www.gatellm.io/models.md)
- [SDK & Framework Integrations](https://www.gatellm.io/integrations.md)
- [AI Coding Agents & Harnesses](https://www.gatellm.io/coding-agents.md)
- [Security & Compliance](https://www.gatellm.io/security.md)
- [Privacy Policy](https://www.gatellm.io/privacy-policy.md)
- [Terms of Service](https://www.gatellm.io/terms.md)
- [Cookie Policy](https://www.gatellm.io/cookies.md)
- [Data Processing Agreement (DPA)](https://www.gatellm.io/dpa.md)
- [Sub-processor List](https://www.gatellm.io/subprocessors.md)
- [Security Questionnaire (CAIQ/SIG/VSA)](https://www.gatellm.io/trust.md)
- [Incident Response & Support](https://www.gatellm.io/sla.md)
- [Vulnerability Disclosure Policy](https://www.gatellm.io/vulnerability-disclosure.md)
- [Open Source License Notice](https://www.gatellm.io/open-source-licenses.md)
- [Version Support & Lifecycle (EOL)](https://www.gatellm.io/lifecycle.md)
- [Engineering Blog](https://www.gatellm.io/blog.md)
- [Your Agents Have More Permissions Than Your Employees: Governing MCP Tools at the Gateway](https://www.gatellm.io/blog/mcp-tool-governance.md)
- [The $10k Invoice Problem: Five Ways to Cut LLM Spend Without Dumbing Down Your App](https://www.gatellm.io/blog/reduce-cost.md)
- [Your Vendor's List Price Is Not Your Cost: Applying Real FinOps to Token Spend](https://www.gatellm.io/blog/token-finops.md)
- [llms.txt](https://www.gatellm.io/llms.txt)