Approach

Security and controls

How we build controls into the systems we deliver, and the records you can use to check them.

Controls we can show you

Defined boundaries
Every system we deliver states what it can reach and what it can change.
People decide
Actions with high impact wait for a person to approve them.
Records, not assertions
Each control produces a record you can review and export.
Least access
Keys, roles, and scopes give each team and application only what it needs.

Controls in AIGate

AIGate puts one controlled point between your teams and AI models.

Access
Virtual keys for each team or application, with rotation and revocation. Provider keys are stored with AES-256-GCM envelope encryption.
Limits
Daily spend budgets and request and token rate limits for keys, teams, and organizations.
Guardrails
Detection of secrets, personal data, and prompt injection, with block, redact, or flag.
Tool approvals
High-impact MCP tool calls wait for a person to approve or deny them.
Records
Audit records hold token counts, latency, and a hash of the content, not the prompt or response text.
Transport
Connections to AIGate use TLS 1.3.
Explore AIGate

Agentic AI with oversight

Agentic AI is implemented as a controlled enterprise capability with defined boundaries and oversight.

Agents act only inside the permissions they are given, high-impact actions wait for a person, and each decision is recorded.

How this website handles your data

We collect only what you send us: the contact form, emails to our addresses, and download requests.

We use one strictly necessary security cookie and no analytics or advertising cookies.

We delete contact-form submissions and emails after 30 days unless they become an ongoing engagement.

Report a security issue

If you find a vulnerability in this website or in AIGate, email compliance@crestocode.com. Include what you found and how to reproduce it. Do not access or change data that is not yours.

See the controls and the records behind them before you decide.