Routing is commodity. We ranked seven AI gateways on what actually matters: what happens to your data after detection. Strac, Cloudflare, Kong, AWS, Azure, IBM and Vercel compared.
.webp)
TL;DR:
Almost every "best AI gateway" list ranks on the same four things: how many models you can route to, how good the caching is, how pretty the cost dashboard is, and how fast the edge network is. Those lists are not wrong, they are just answering a question that no longer separates the options. Routing is solved. Several vendors give it away specifically so you will buy inference, hosting or edge bandwidth from them.
The question that does separate them is what the gateway does to the contents of a request. Once an agent reads a customer record, a mailbox or a scanned invoice, every value in it travels to a model provider as ordinary API traffic. This list ranks on that. For the underlying mechanics see what is an AI gateway, and for the agent-side risks see AI agent security.
Five criteria, weighted toward the ones that change outcomes rather than dashboards:
Substitution is the same reversible-token idea behind data masking, applied to traffic in flight rather than data at rest. For the endpoint and file side of the problem, see Endpoint DLP.
One distinction decides this whole category, so it is worth stating once and precisely. Several gateways can now detect sensitive data. What almost none of them can do is substitute it. Detection plus blocking stops the request, which stops the agent. Detection plus deletion lets the request through but leaves the model nothing to refer to, so it cannot write the email or build the follow-up query. Only substitution, swapping each value for a stable token and restoring it on the way back, lets the work finish while the provider receives nothing real.
Best for: agents that handle regulated data and still have to finish the job.
Strac is the only gateway on this list that substitutes and restores across the full path, inside tool calls and on images and PDFs. Sensitive values are detected and swapped for tokens before the request leaves your boundary, the model reasons over tokens, and the real values are restored in the model's answer and inside its tool calls before your application acts. The refund gets issued, the email reaches the right customer, and the provider holds nothing real.
Detection spans 255 data element types across PII, PHI, PCI and secrets, including 160 national ID formats, plus custom elements and exclusions. Coverage includes prompts, query results, command output, logs, JSON, CSV, images via OCR and PDFs. Connecting an application is one environment variable and zero changes to code, prompts or tools.
Tokens are deterministic, which matters more than it sounds: the same value always produces the same token, so resent conversation history stays byte-identical and provider prompt caching keeps working. Redaction schemes that emit a fresh mask per request quietly destroy your cache hit rate.
It runs as SaaS or fully self-hosted in your VPC, on-prem or your customer's infrastructure, with detection models bundled in the image, no calls home, and an AES-256-GCM token vault on storage you control.
The honest limitation: routing, failover and cost dashboards are on the roadmap rather than shipping today. We built the detection engine and the vault first because that is the part that is genuinely hard and the part that decides whether AI ships in a regulated environment. Read the full breakdown in what is an AI gateway.
Best for: teams already on Cloudflare who want edge-speed routing with basic data controls.
Cloudflare is the strongest of the routing-first options and the only edge provider that has shipped a real DLP feature inside its AI gateway. Caching, rate limiting, analytics and failover are mature, the edge network is excellent, and for a team already running Cloudflare the integration cost is close to zero.
The ceiling is what happens after detection. Cloudflare's DLP detects and blocks. For a chat assistant that is a reasonable outcome. For an agent executing a workflow, a blocked request is a failed job, and you end up choosing between turning the policy off and accepting that your automation stops whenever it encounters a customer record. There is also no reversible token vault, so there is no path to letting the model work with a placeholder and getting the real value back. We cover the same block-versus-substitute tradeoff on the tool-call path in MCP DLP.
Best for: enterprises standardizing on Kong for all API traffic.
Kong brings a mature API gateway heritage: plugins, traffic policy, rate limiting, authentication and a deployment model enterprises already know. If Kong is your API layer, running model traffic through the same control plane is operationally clean and your platform team already understands it.
Kong is the one incumbent here that took the data layer seriously. Its AI PII Sanitizer plugin, shipped in Kong Gateway 3.10, detects PII with an NLP model and can replace values with placeholders or same-type surrogates, with an optional restore step that reinstates the originals in the response. That is real substitution, and it predates Cloudflare's DLP. The limits are where agents actually live: restoration covers the response body, not values inside tool calls, so an agent acting on the model's tool output still gets tokens. Detection is text only, with no OCR path for the scanned invoice an agent just opened. And the sanitizer runs as a separate container alongside the data plane, so it is another service to operate. Excellent traffic governance, the closest any incumbent gets on data, with the agentic path still open. The equivalent control for the inbound agent path is covered in MCP gateway.
Best for: AWS-native teams who want model governance inside their existing account boundary.
Staying inside AWS means IAM, VPC, CloudTrail and your existing compliance posture carry over, which is a real advantage. Guardrails apply content policy to prompts and completions, and AgentCore adds structure for agent workloads.
The gap is coverage of the agentic surface, and AWS has tried to close it without getting there. The native inline path on Converse and InvokeModel skips toolResult, toolUse.input and toolSpec entirely, per AWS's own documentation: neither blocked nor masked. AWS then shipped InvokeGuardrailChecks in June 2026 for agentic loops, but it is detect-only, returning confidence scores you must write your own enforcement around and wire into every step yourself. AgentCore Policy, GA the following day, suppresses the entire tool response, which is the blocked-agent failure this list argues against. And ANONYMIZE masking is irreversible. Every AWS path is detect, block or suppress; none of them substitute and restore. See MCP data security for how that retrieval path behaves in practice.
Best for: Microsoft shops that want model traffic governed by the same platform as everything else.
Azure API Management has added AI gateway capabilities including token limits, semantic caching and load balancing across model deployments. For a Microsoft-standardized enterprise this is the lowest-friction option and inherits Entra identity and existing policy.
On data, Azure leans on Purview and platform policy rather than inline substitution. Purview does not inspect the agent-to-model path by default, so the common failure is assuming coverage you do not have. Governance and identity are strong here. Content substitution is not part of the model. If you are evaluating Microsoft-native coverage, AI DLP walks through where Purview stops.
Best for: large regulated enterprises already invested in IBM governance tooling.
IBM's strength is governance framing: model inventory, approval workflow, documentation and the audit artifacts that large regulated organizations need to show a committee. If your AI programme is being run as a governance programme, that structure has real value.
IBM does inspect in real time, but in the wrong place for this problem: the PII detector lives in watsonx.governance, not in the gateway data path, and it only covers watsonx-hosted inference. It detects and blocks without restoring, so an agent calling OpenAI or Anthropic through the gateway gets no data-layer coverage at all.
Best for: product teams shipping AI features on Vercel who want routing to disappear as a concern.
Vercel's gateway is the smoothest developer experience on this list. One endpoint, many models, failover handled, billing unified, and if you already deploy on Vercel it is close to free in both money and effort.
It is built for application developers, not for a security review. There is no classifier, no tokenization and no self-hosted story, so it is a poor fit the moment regulated data enters the request. Excellent at what it targets; it simply does not target this problem. If shadow usage is your real concern, start with shadow AI instead.
| Gateway | After detection | PII in files, images, PDFs | Restores values inside tool calls | Self-hosted |
|---|---|---|---|---|
| Strac | Substitutes (tokenize and restore) | Yes, OCR and PDF | Yes | Yes, no calls home |
| Cloudflare AI Gateway | Flags or blocks; never restores | Limited | No | No |
| Kong AI Gateway | Substitutes, restores in response only | No | No | Self-managed or Konnect SaaS control plane |
| AWS Bedrock Guardrails | Detects, blocks or suppresses; never restores | Images for harm categories only, not PII; no PDFs | No | Your AWS account |
| Azure API Management | Policy based | No | No | Your Azure tenant |
| IBM API Connect AI Gateway | Detects and blocks (watsonx only) | No | No | Self-managed or IBM Cloud |
| Vercel AI Gateway | Not a data control | No | No | No |
See it on your own data. Send a few examples of what your agents handle and Strac returns a tuned policy plus a report of exactly what the model would have seen. Book a demo or browse the integrations your agents already touch.
Because the mapping is stable, the model can tell two rows belong to the same customer and refer back to a person later in a long thread. It simply never learns who that person is. That stability is also what keeps prompt caching intact.
A shortcut that saves a lot of evaluation time: ask each vendor what happens to a request containing a customer's Social Security number when the agent needs that record to complete a task. Most will describe blocking. A few will describe deletion. If the answer is not "the model gets a token and your agent gets the real value back," the agent breaks and you will be turning the policy off within a month.
For the inbound half of the problem, meaning what agents are allowed to pull from your systems in the first place, see MCP gateway and MCP DLP.
Strac detecting and remediating sensitive data in Slack. The AI Gateway applies the same detection engine to the API path between your agents and the model.
It depends on what is actually blocking you. If the problem is managing provider keys, spreading traffic across models and tracking spend, the cloud incumbents all solve that and you should pick whichever is closest to your existing stack. If the problem is that your agents handle regulated data and you cannot let it reach a model provider, Strac is the only option on this list that tokenizes values on the way out and restores them on the way in, including inside tool calls, so the agent finishes the job and the provider holds nothing real.
Yes, Cloudflare added a DLP feature to AI Gateway, and it is a genuine capability rather than marketing. The limit is what it does after detection: it detects and blocks. For a chat assistant that is an acceptable outcome. For an agent running a multi-step workflow, a blocked request is a failed job. Strac detects the same categories and then substitutes rather than blocks, which is the difference between an agent that stops and an agent that completes.
Only if it rewrites request content, which most do not. Routing, caching and logging change how a request is delivered, never what is inside it. To keep PII off a provider's servers the gateway has to detect sensitive values in the outbound request and replace them before it leaves your boundary, then restore them in the response and in any tool calls so your application still works.
Routing and failover matter less with one provider, but the data question is identical. A single-provider setup still sends every prompt, query result, log line and uploaded document to someone else's servers. If that traffic carries regulated data, you need a control on the path no matter how many providers you use.
The routing-first products typically price on a markup over tokens or bundle the gateway free with hosting or edge services, because the gateway is there to sell you something else. Strac prices as a data security product rather than a token proxy, and there is no public price list. Send us a sample of what your agents handle and we will scope it against your actual traffic.
With most of this list, no: they are cloud services by design. Strac ships a self-hosted Docker container that runs in your VPC, on-prem, or inside your customer's infrastructure. Detection models are bundled in the image and run on your own CPUs with no calls home, the token vault is AES-256-GCM encrypted on storage you control, and the gateway's only network egress is to the model provider.
“Don’t just alert on problems, fix them.”
Scott Roberts, Chief Information Security Officer, UiPath
.webp)
.avif){kind=icon}
Customers include
.gif)
