Security & Compliance

Infrastructure Security

Ingate is a fully managed cloud platform. There are no self-hosted components to configure or patch. All infrastructure is operated, monitored, and hardened by the Ingate team.

Every HTTP response from Ingate includes a hardened set of security headers:

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), camera=(), microphone=()
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Authentication

Ingate uses two authentication methods: API keys for machine-to-machine access and session tokens for the dashboard.

API Key Authentication

Every proxy and API request requires your key in the X-Ingate-Key header. Keys are header-only: they are never accepted in query parameters, preventing accidental exposure in server logs, browser history, or referrer headers.

curl https://api.ingateai.com/v1/chat/completions \
  -H "X-Ingate-Provider: openai" \
  -H "X-Ingate-Key: sk-ingate-your-key" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-4o-mini", "messages": [{"role": "user", "content": "Hello"}]}'

Keys are stored as SHA-256 hashes. Raw key values are never persisted, never logged, and never included in error responses. Only a truncated hash prefix is used for log correlation.

Dashboard Authentication

Dashboard login uses email and password. Passwords are hashed with bcrypt before storage. Session tokens are signed with HMAC-SHA256 and are short-lived.

# Login (returns session token)
curl -X POST https://api.ingateai.com/api/v1/login \
  -H "Content-Type: application/json" \
  -d '{"email": "dev@acme.com", "password": "your-password"}'

Brute Force Protection

Login and signup endpoints are rate limited to 10 attempts per 15 minutes per IP. Exceeding the limit returns 429 Too Many Requests with a Retry-After header.

{
  "error": "rate limit exceeded",
  "error_code": "rate_limited",
  "retry_after_seconds": 900
}

Authorization (RBAC)

Ingate enforces deny-by-default role-based access control. If the auth context is missing or invalid, access is denied. Requests are never silently passed through.

Roles follow a linear hierarchy: higher roles inherit all permissions of lower roles. All data is org-scoped: users in one organization can never access another organization's data, keys, logs, or settings.

Provider Key Security

Provider API keys (OpenAI, Anthropic, etc.) are stored with AES-256-GCM authenticated encryption at rest. They are decrypted only at the moment a request is forwarded upstream and are never exposed to clients.

# Rotate a provider key. Existing clients are unaffected
curl -X PUT https://api.ingateai.com/api/v1/providers/openai \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"api_key": "sk-new-openai-key..."}'

PII Redaction

Automatically redact sensitive data from request and response logs before persistence. Three redaction modes are supported:

Default patterns detect and redact these data types out of the box:

• Email addresses: standard RFC 5322 patterns
• Social Security Numbers: XXX-XX-XXXX format
• Credit card numbers: Visa, Mastercard, Amex, Discover
• Phone numbers: US and international formats

Data Retention

Data approaching the retention boundary can be exported via the API at any time. On Enterprise plans, configure webhook delivery to push logs to your own storage before expiry.

# Export logs before retention expiry
curl "https://api.ingateai.com/api/v1/logs?start=2025-01-01&end=2025-01-31&format=jsonl" \
  -H "Authorization: Bearer <token>" \
  -o logs-jan-2025.jsonl

Rate Limiting

Multiple layers of rate limiting protect against abuse, runaway costs, and denial-of-service:

When a rate limit is exceeded, the response includes standard headers for client backoff:

HTTP/1.1 429 Too Many Requests
Retry-After: 60
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 0

Compliance

Ingate is built for organizations with strict security and compliance requirements.

Security Summary

A quick reference of all security controls enforced across the platform: