LLM Gateway Is Now SOC 2 Type II Compliant

We're excited to announce that LLM Gateway is now SOC 2 Type II compliant. An independent auditor has examined our security controls — not just how they're designed, but how they operated in practice over an extended observation period — and verified that we meet the AICPA's Trust Services Criteria for security, availability, and confidentiality.

Your prompts, completions, and API keys flow through your gateway. That's a position of trust, and this report is third-party evidence that we treat it that way.

What is SOC 2?

SOC 2 is a compliance framework developed by the American Institute of Certified Public Accountants (AICPA) for assessing how service organizations protect customer data. An independent CPA firm audits the organization's controls against the Trust Services Criteria — covering areas like access control, change management, incident response, vendor management, and data protection.

There are two types of SOC 2 reports:

• Type I evaluates whether your security controls are suitably designed at a single point in time.
• Type II goes further: it verifies that those controls actually operated effectively over a sustained observation period, not just on the day of the audit.

Type II is the report enterprises ask for, because it demonstrates that security isn't a checkbox exercise — it's how the company runs day to day.

What this means for you

If you're routing production LLM traffic through LLM Gateway — or evaluating us against your security requirements — this gives you:

• Independent verification. You don't have to take our word for how we handle your data. A third-party auditor has examined our controls in operation.
• Faster security reviews. Instead of a months-long questionnaire cycle, your security team can review our SOC 2 Type II report and our trust center directly.
• A shorter path to procurement. For many enterprises, a current SOC 2 Type II report is a hard requirement before any vendor touches production data. We now clear that bar.

This matters double for an LLM gateway: we sit between your application and every model provider you use. Centralizing that traffic is only a good idea if the layer in the middle holds itself to a higher standard than the integrations it replaces.

Security has always been part of the product

SOC 2 Type II formalizes practices that have been core to LLM Gateway from the start, and it complements the security features our customers already rely on:

• Audit logs — tamper-evident trails of every config change, key rotation, and admin action, exportable for your own SOC 2 and HIPAA evidence.
• Guardrails — prompt-injection detection, PII redaction, and content moderation at the gateway layer.
• SSO/SAML and role-based access control for your team.
• Per-project routing overrides — pin regulated workloads to specific regions and providers to keep your own compliance scope tight.
• Open source — our core is AGPLv3 on GitHub, so you can inspect exactly how your data is handled.

Enforce SOC 2 across every provider you route to

Our own SOC 2 Type II report covers LLM Gateway — but your requests don't stop at the gateway. They fan out to model providers, and each provider has its own certifications and data policies.

That's what provider compliance policies are for. On the Enterprise plan, you set the requirements once — SOC 2 Type II, ISO 27001, GDPR compliance, no training on prompts, no prompt logging — and the gateway blocks any request that would reach a provider that doesn't meet them, before any data leaves the gateway. Every requirement is fail-closed: a provider with an unknown attribute counts as non-compliant.

The dashboard makes the policy visible before you commit to it. The compliance settings page shows a live Provider Impact preview of exactly which providers your policy allows and blocks, and every provider picker in the dashboard is policy-aware — a green shield marks providers that meet your active requirements, a red shield lists exactly which ones they miss. You can also restrict routing to providers headquartered in specific countries, which pairs SOC 2 requirements with data-residency ones.

For a walkthrough of retention controls and residency-aware routing, see our LLM compliance checklist and the guides on data retention and EU routing.

How to get our SOC 2 report

Our trust center at security.llmgateway.io is the home for our security posture: certifications, policies, and subprocessors. You can request access to the full SOC 2 Type II report there.

Have a custom security questionnaire or specific compliance requirements? Contact us — our team is happy to work through them with you.

Put a compliance boundary in front of your LLM traffic

If SOC 2 evidence is on your procurement checklist, you likely also need to control where prompts are allowed to go — not just audit it after the fact. That's an Enterprise capability, and it's usually a 30-minute conversation to scope:

• Talk to us about Enterprise — compliance policies, custom data retention periods, audit logs, and SSO/SAML.
• Read the compliance policy docs — how enforcement, the country filter, and custom-provider attestations work.
• Try LLM Gateway free — the gateway itself, on any plan.