Occludra AI is an open-source AI firewall and governance gateway that sits between your applications and LLM providers. It acts as a stateless proxy — prompts pass through and are never written to disk, logged, or used for training. Only metadata (cost, latency, entity counts) is recorded. Occludra protects sensitive data, controls spending, and enforces compliance (PII, PCI, HIPAA) for teams using OpenAI, Anthropic, Google Gemini, and 8+ other providers.
Key Features
Multi-Modal PII Redaction — 30+ entity types in text + OCR-based image scanning
Prompt Injection Protection — Blocks jailbreaks, DAN, instruction overrides in real time
Recursive Loop Protection — SHA-256 fingerprint + sliding window kills agent retry loops (LangChain, CrewAI, AutoGen). HTTP 429 after 5 identical requests in 60s.
Webhook Notifications — HMAC-SHA256 signed real-time alerts for PII blocks, injection attempts, budget exhaustion, and loop detection. Push to Slack, PagerDuty, or any SIEM.
EU AI Act Compliance Logging — Hash-chained tamper-evident audit records with SHA-256 input/output fingerprints. No raw content stored. JSONL export + chain verification API.
Smart Autonomous Routing — Cheapest/fastest across OpenAI, Anthropic, Groq, Gemini, Mistral, Llama, xAI, and more
Budget Enforcement — Hard per-project caps, pre-flight checks, token quotas
Python SDK — pip install aisg. Typed exceptions: LoopDetectedError, BudgetExhaustedError, PIIBlockedError
2-Line Integration — OpenAI SDK compatible
Zero Data Retention — Fully stateless; compliance records store only SHA-256 fingerprints
SAML SSO — Okta, Azure AD, Google Workspace, any SAML 2.0 IdP. Auto-provisioning +enforced SSO.
RBAC — 4-tier roles (Owner/Admin/Member/Viewer), 17 granular permissions
SIEM Connectors — Native Splunk HEC, Datadog Logs, Microsoft Sentinel integration. Real-time event streaming.
Hybrid VPC Deployment — Compiled Go proxy runs in your VPC, prompts never leave your network. Cloud dashboard for policies via metadata-only telemetry. Docker Compose or Kubernetes.
MCP Gateway (private beta) — DLP firewall for Model Context Protocol tool calls. Scans tool descriptions for poisoning at catalog time, applies per-direction PII DLP (block outbound tool arguments; redact/block inbound tool results), enforces default-deny tool allow/deny, and degrades gracefully when a downstream server fails. Cloud or in-VPC.
BYOK (Bring Your Own Key) — 0% markup on your own provider keys
Three deployment models: Open Source (Apache 2.0) · Managed Cloud · Hybrid VPC
Enterprise tier — Custom pricing for regulated industries
1M Free Credits on signup — no credit card required
Open-source self-hosting under Apache 2.0: https://github.com/occludra/gateway
Use Cases
Data Protection & Compliance: Organizations handling sensitive user data (names, emails, SSNs, credit cards) can prevent leaks to LLM providers, ensuring compliance with HIPAA, PCI, and GDPR. Occludra redacts PII before data leaves the system — even from images via OCR — ensuring business context passes through while sensitive details are scrubbed.
Cost Control & Optimization: For businesses using multiple AI providers, Occludra intelligently routes each request to the cheapest available model, enforces hard spend limits per API key (HTTP 402 when exceeded), and prevents runaway costs from unexpected usage. No surprise bills from autonomous agents or batch jobs.
Security & Governance: Occludra blocks prompt injections, provides project-level DLP policies for different teams, and supports custom regex for proprietary data patterns. It delivers a zero-trust governance layer where prompts are inspected in transit and never retained.
Pricing Information
Occludra offers a freemium model with two plans. The "Managed Credits" plan is free to start with 1,000,000 free credits (no credit card required), then usage-based with a 25% markup on open-source models and 30% on closed models. The "Pro BYOK" plan costs $29/month — bring your own API keys, pay providers directly with zero AISG markup. Both plans include the full governance layer.
User Experience and Support
Integration is designed for existing OpenAI SDK apps — change two lines of code (base URL + API key) and your traffic is protected in under 30 seconds. The security firewall adds ~50ms for text requests. Occludra provides comprehensive documentation at aisecuritygateway.ai/docs, a blog with technical guides, and email support. The open-source version includes full Docker Compose setup for self-hosting.
Technical Details
Occludra operates as a fully stateless proxy. Prompts pass through and are never written to disk, logged, or used for model training. Only metadata (cost, latency, entity counts) is recorded. BYOK API keys are encrypted at rest with AES-256-GCM. The entire stack can be self-hosted in your own VPC under an Apache 2.0 license — no vendor lock-in, no telemetry, no data leaving your infrastructure. GitHub: https://github.com/occludra/gateway
