cashcrown // ai security layer
Guardrails Gateway
guardrails-gwliveA single controlled entry point for every LLM call: model-to-task routing, PII masking before the model, input and output guardrails, per-tenant budgets, and a full audit log.
4 tryby
guardrail modes
zero-retention
data
self-host
deploy
1×
entry point
// 01
Problem
LLM calls scattered across your code are an uncontrolled risk: PII reaches the model, prompt-injection and jailbreaks pass unfiltered, and there are no per-team budgets or audit trail. Without a single gateway, none of it is governable or defensible under GDPR.
// 02
Capabilities
- model-to-task routing with fallback
- PII masking before anything reaches the model
- input and output guardrails: prompt-injection, jailbreak, secrets, harmful output
- per-tenant access and budgets + a full audit log
- zero-retention: content is not stored after handling
// 05
Integrations
OpenClawBGE-M3QdrantOllaman8n
// 06
Architecture
Select a node to see its description and data flow.
Architecture — text description
- Ingest / data
- Data sources — Content, documents and events feed the index. (Flows to: BGE-M3)
- BGE-M3 — Local embeddings (1024-dim) — PII stays on-prem. (Flows to: OpenClaw router)
- AI core
- OpenClaw router — The only entry to the models — masks PII, picks the model, throttles. (Flows to: Guardrails Gateway)
- Guardrails Gateway — A single controlled entry point for every LLM call: model-to-task routing, PII masking before the model, input and output guardrails, per-tenant budgets, and a full audit log. (Flows to: API)
- Serve / integrations
- API — REST surface — cited answers with access control. (Flows to: OpenClaw, BGE-M3, Qdrant, Ollama)
- OpenClaw — Integration: OpenClaw.
- BGE-M3 — Integration: BGE-M3.
- Qdrant — Integration: Qdrant.
- Ollama — Integration: Ollama.
// 07
Live demo
// 08
FAQ
How much does it cost and what does the rollout look like?
We work in ranges that depend on scope — we start with a fixed-cost pilot in which we put the gateway in front of a few existing LLM calls and show the audit log and the attack attempts it caught. When the layer removes incident risk and manual-review time, it usually pays off in 2–4 months. It reduces risk and adds control — it is not a guarantee of perfection. Estimate the return in the ROI calculator.
Does it integrate with our systems and is it GDPR-compliant?
Yes. The gateway sits in front of your current model calls — you do not change provider, you route existing traffic through one point. We mask PII before the model, handle sensitive paths locally, run content with zero-retention, and every call lands in the audit log. GDPR and AI Act compliance is designed in from the start — it makes your case defensible, while a human stays in the loop on decisions.
Where do we start, and will it stop every attack?
We start with one most-exposed flow — for example an assistant over customer data — put it behind the gateway, and run the guardrails in observe mode first so you see the traffic without blocking it. Then we tighten the rules step by step and expand to more calls. Honestly: no filter catches 100% — the goal is a meaningful drop in risk, auditability, and a human making the final call on irreversible actions.
// →Related