# One LLM gateway for every AI call.

> SecondGate, the LLM gateway you run: model access and budgets per team, person or key, and guardrails that mask personal data and secrets before a call leaves.

- Canonical: https://secondstack.ai/platform/gateway/

---

SecondStack is an AI agent platform. This view covers SecondGate, the LLM gateway, and SecondGuard, the guardrails inside it: the check before a call leaves, budgets per team, person and key, and what a per-seat assistant does not cover.

People in the web app, agents on a schedule and other systems on API keys all reach the AI models through SecondGate, an LLM gateway you run yourself: Claude, GPT, Gemini or models you host, on your own provider accounts. The same checks, budgets and record apply to every call.

Illustrative example. Aster, the personal agent, carries a request to SecondGate. It checks the model, masks the card number and counts the cost, then the request goes on to the AI provider with the card number replaced by a placeholder.

- Before masking: `Approve invoice 4471, card •••• 4455`
- After masking: `Approve invoice 4471, card [CARD_1]`

## People, agents and apps share one AI gateway.

One path for every call, whoever makes it: a person, an agent or another system on an API key. That is what makes the agent rules enforceable: an agent cannot go round the gateway.

- **SecondGate**: The LLM gateway: which model, whose keys, what it cost
- **SecondGuard**: Guardrails: personal data and secrets masked by the rules you set

Works with: Anthropic, OpenAI, Google and your own models.

**Your infrastructure.** Your own provider accounts, and every chat, file and agent run in your own database. We do not host or resell models.

## Before a call leaves, the gateway checks it.

The agent's model has to be on the list its team approved. SecondGuard, the guardrails inside the gateway, applies your rules: it can replace personal data and secrets with placeholders before the request leaves and restore them in the answer.

## Budgets for teams, people and API keys.

Budgets go from organization to team to person, and API keys have budgets of their own. Agent traffic is charged like everything else, and alerts go out when spend passes a threshold you set.

## Already paying per seat for an assistant?

Keep it if it works for your people. Here is what a seat does and does not buy.

- "We already have ChatGPT Enterprise." Then your people have a chat app with agents in it. What the seat does not include is the layer underneath: which models, whose keys, what leaves the building, who pays.
- "We already buy Claude Enterprise." Keep it. SecondStack is not bought instead of Claude; it puts Claude on the same keys, budgets and audit trail as everything else you use, on your own Anthropic account.
- "We have Microsoft 365 Copilot." It covers Microsoft 365. Calls to other models and from your own apps need their own controls.

Current list prices of the models the gateway works with: [Model prices](https://secondstack.ai/llm-pricing/)

## Questions about the LLM gateway.

### Which models can we reach through SecondGate?

The providers where you already have accounts, including Anthropic, OpenAI, Google and self-hosted models, through your own keys. Which models a team, a person or an agent may use is a list you set in ControlTower, the admin console. Because every call goes through one gateway, moving traffic to another provider is a setting, not a project. We do not host or resell models.

### How is the gateway priced?

By consumption, not per seat. Model usage is billed by your providers on your own accounts, and budgets by organization, team, person, key and agent keep the total predictable. Ask us for the current terms.

## Further reading

- [What is an LLM gateway?](https://secondstack.ai/blog/what-is-an-llm-gateway/)
- [LLM guardrails: PII and secrets before egress](https://secondstack.ai/blog/llm-guardrails/)
- [LLM cost management: budgets, alerts, per-team visibility](https://secondstack.ai/blog/llm-cost-management/)

## See one call go through the gateway.

Bring a system that already calls a model. We route one of its calls through SecondGate on the demo call and show which budget pays, which masking rule applies and what the record keeps.

Book a demo: hello@secondstack.ai