Govern enterprise AI before sensitive data reaches a provider.

ProxiAI is a tenant-aware AI gateway that applies policy, protects sensitive information, and records auditable operational evidence before approved requests reach an AI provider.

Try Live Demo View GitHub Read architecture

Interactive demo may be started on demand.

User or application request

PROXIAI CONTROL BOUNDARY

Tenant authPII + policyAudit + usage

Approved provider adapter

WHY A GATEWAY

Enterprise AI needs more than a direct provider key.

ProxiAI inserts one trusted control boundary between employees and the external model path.

Uncontrolled provider access

Direct AI access can bypass organisation policy, identity boundaries, and consistent operational controls.

Sensitive-data egress

Prompts may carry contact, financial, government, credential, internal-secret, or business-confidential data.

Missing operational evidence

Security and operations teams need bounded audit, usage, policy, and delivery evidence without storing raw sensitive values.

SYSTEM SHAPE

A policy-aware gateway with explicit trust boundaries.

The Express API stays authoritative. Every tenant-owned query uses trusted organisation context, while provider SDK details remain inside adapters.

User / Client

Auth + Tenant Context

PII + Policy

Provider Abstraction

Groq

MongoDB

Tenant records, append-only usage/audit, encrypted or metadata-only history

Redis + BullMQ

Idempotency, rate limits, workers, health, and durable enqueue recovery

Operations

Low-cardinality metrics, safe logs, dashboards, alerts, and runbooks as code

REAL REQUEST LIFECYCLE

Every request follows a deterministic order.

Security checks happen before provider execution. Persistence and background work happen only through approved boundaries after the outcome is known.

ALLOW

Approved prompt continues to the configured provider path.

ALLOW_WITH_MASK

Only the masked providerPrompt crosses the provider boundary.

BLOCK

The request stops before streaming; zero provider calls are made.

01Authentication
02Trusted tenant and permissions
03Strict request validation
04Idempotency and rate limits
05Authoritative token budget
06PII detection, classification, and risk
07ALLOW / MASK / BLOCK policy
08Provider retry, circuit, and routing
09SSE response
10Retention, accounting, and audit
11BullMQ background jobs

PRODUCT SURFACES

Chat for employees. Evidence and controls for administrators.

The product UI exposes the same backend truth rather than recreating policy, billing, or provider rules in the browser.

SURFACE 1

Chat workspace

Conversation navigation, policy-aware streaming, safe Markdown, and explicit retention context.

SURFACE 2

Policy inspector

Decision, risk score, detected category counts, masking state, and authoritative provider routing.

SURFACE 3

Admin operations

Tenant users, teams, policy, budget, retention, sessions, alerts, analytics, and append-only audit export.

SECURITY DESIGN

Protect data without hiding the enforcement boundary.

Implemented controls are explicit, tenant scoped, and tested. ProxiAI does not convert planned capabilities into public claims.

Deterministic sensitive-data controls

Rule-based detection preserves source spans, classifies without raw values, scores risk, and masks derived prompts without mutating the original request.

CONTACT_INFO
FINANCIAL
GOVERNMENT_ID
CREDENTIAL
INTERNAL_SECRET
BUSINESS_CONFIDENTIAL

Encrypted or metadata-only retention

AES-256-GCM storage uses a versioned runtime keyring, unique IVs, and tenant/resource-bound AAD. Encryption failure is strict: there is no plaintext fallback.

METADATA_ONLY

No message content is stored.

ENCRYPTED_STORAGE

Completed user and assistant content is stored as ciphertext for owner-authorized reads.

Database-backed RBAC

Access tokens identify the session; current user status, organisation status, role, and canonical permissions are reloaded from the database.

EMPLOYEE

Restricted chat and own-conversation access through canonical permissions.

TEAM_LEAD

Team-scoped capabilities only when current permissions and tenant context allow them.

ORG_ADMIN

Tenant administration, policy, billing, audit, and user operations through audited mutations.

Append-only audit trail

Tenant-scoped, bounded safe metadata.
Required admin mutations commit with their audit event.
AuditLog update and delete operations are forbidden.
CSV export protects against spreadsheet formula injection.
No raw prompt, password, token, or secret payload.

RELIABILITY + ASYNC

Failures are normalized, retried carefully, and recorded safely.

Provider execution and background accounting use separate, bounded failure paths so chat delivery does not invent billing truth.

Provider boundary

Canonical adapters normalize completion, streaming, health, usage, and failures. Bounded retry and circuit state are reusable across candidates.

Groq is the only enabled production provider. The ordered fallback abstraction is tested, but the current production chain has one candidate.

Async accounting

Append-only RequestLog records known usage. Idempotent BullMQ workers reconcile billing and tenant-scoped analytics without mutating the source record.

Unknown provider usage remains unknown; no synthetic token or cost value is created.

Operational recovery

Worker heartbeats, provider-health state, failed-job retention, analytics/anomaly processing, and durable enqueue recovery make background failure visible and bounded.

Prompt, response, PII, credentials, and raw provider errors stay out of job payloads and logs.

OBSERVABILITY BOUNDARY

Instrumentation exists without pretending hosted delivery is always running.

Safe structured logs, a protected Prometheus-compatible metrics endpoint, low-cardinality labels, dashboard and alert definitions, and runbooks are implemented. Continuous hosted collection and alert delivery can remain intentionally deferred while the demo environment is deep-stopped.

VERIFIED RELEASE EVIDENCE

Engineering claims tied to a named evidence baseline.

This is dated internal release evidence from the repository audit baseline. It is not an external certification and does not silently track later commits.

Evidence:: Final gap audit baseline
Date:: 2026-08-22
Source commit:: 789136c

269 / 269

Backend tests

28 / 28

Frontend tests

63 / 63

Isolated integration

78.24%

Backend line coverage

77.62%

Frontend line coverage

CANONICAL DEPLOYMENT

AWS ECS/Fargate with a private application tier.

Immutable ECR images define separate frontend, API, and worker ECS/Fargate services. Secrets stay in AWS Secrets Manager rather than the frontend bundle or image layers.

1Route53 + ACMPublic DNS and TLS
2Application Load BalancerFrontend default; /api and /health to API
3Next.js taskPublic product surface
4Express API taskAuthoritative application boundary
5BullMQ worker taskPrivate, long-running background processing
6Atlas + Redis + GroqExternal runtime dependencies reached from private application networking

The low-traffic demo uses one task per service and snapshot-driven deep stop/start for cost control. This is not a multi-task high-availability claim.

HONEST LIMITATIONS

What the current release does not claim.

A trustworthy demo states what is deferred and what cannot be recovered, rather than filling the gaps with synthetic evidence.

1The interactive demo may be deep-stopped and started on demand for cost control.
2Attachments are deferred; there is no upload or multipart API in this release.
3Prompt caching and completed-response replay remain deferred pending safe storage contracts.
4Interrupted provider usage stays unknown when the provider supplies no authoritative usage; ProxiAI never estimates it as zero.
5Continuous hosted metrics collection and alert delivery may be intentionally deferred while demo infrastructure is stopped.
6No external penetration-test or compliance certification is claimed.

See the governed request path in action.

The public demo account is restricted to employee chat permissions and must not be used with real personal or confidential data.

Try Live Demo Inspect the code