> For the complete documentation index, see [llms.txt](https://docs.trezalabs.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.trezalabs.com/ai-gateway/ai-control-plane.md).

# Overview

The Treza AI Gateway is a managed **PII redaction proxy** for LLM traffic. Instead of sending prompts directly to OpenAI (or another provider), your application sends them to a Treza proxy endpoint. Treza detects and redacts personally identifiable information, forwards the sanitized request to your configured upstream provider, and returns the provider's response, so raw PII never reaches the model provider.

You keep your existing OpenAI-compatible client and SDK. Switching to the gateway is a base-URL change plus two headers.

{% hint style="info" %}
The gateway's redaction engine is the same one behind the **PII guardrail node** inside pipelines. Use the gateway to protect an existing OpenAI-based app with a base-URL change, or drop a redaction node into a [pipeline](/pipelines/pipelines.md) to handle PII mid-graph.
{% endhint %}

### Why route LLM traffic through Treza?

* **PII never leaves your trust boundary in plaintext prompts.** Emails, phone numbers, SSNs, credit cards, and other sensitive values are replaced with placeholders like `[EMAIL_1]` before the request is forwarded upstream.
* **Per-proxy policies.** Each proxy bundles an upstream provider, a stored (encrypted) provider key, and a redaction policy describing which entity types to strip.
* **Audit trail.** Every request writes a redaction audit entry — entity counts by type, engine versions, and an attestation reference — retrievable via API or the dashboard.
* **Attested redaction (Enterprise).** Redaction can run inside a Treza Enclave (AWS Nitro) with hardware attestation, so you can prove *where* the redaction happened.

### Architecture

```
Your app / agent                Treza AI Control Plane                 LLM Provider
┌──────────────┐   OpenAI-     ┌─────────────────────────┐           ┌─────────────┐
│ OpenAI SDK / │   compatible  │ 1. Authenticate API key │  redacted │ OpenAI /    │
│ fetch        │──────────────▶│ 2. Redact PII           │──────────▶│ Azure /     │
│              │               │    [EMAIL_1], [SSN_1]…  │           │ Anthropic / │
│              │◀──────────────│ 3. Forward upstream     │◀──────────│ custom      │
└──────────────┘   response +  │ 4. Write audit entry    │  response └─────────────┘
                   x-treza-*   │ 5. Meter usage          │
                   headers     └─────────────────────────┘
```

The proxy endpoint is OpenAI-compatible:

```
POST https://trezalabs.com/api/redact/chat/completions
```

It authenticates with a Treza API key (`redact:proxy` scope), selects an upstream via the `x-treza-proxy` header, redacts every message, and forwards the request body unchanged otherwise. The response is returned with `x-treza-request-id` and `x-treza-mode` headers.

{% hint style="info" %}
The model only ever sees placeholders. If the model's reply references a placeholder (e.g. "I'll email \[EMAIL\_1] tomorrow"), send the `x-treza-rehydrate: 1` request header to receive the placeholder → original-value map in the `x-treza-rehydration` response header and restore values client-side. Original values are never sent upstream.
{% endhint %}

{% hint style="warning" %}
Streaming is not yet supported by the redaction proxy. Requests with `"stream": true` are rejected with `400` — omit `stream` or set it to `false`.
{% endhint %}

### What gets redacted

The redaction pipeline detects the following entity types (used in placeholders and policies):

| Entity type | Description                              |
| ----------- | ---------------------------------------- |
| `NAME`      | Person names                             |
| `EMAIL`     | Email addresses                          |
| `PHONE`     | Phone numbers                            |
| `ADDRESS`   | Physical addresses                       |
| `SSN`       | US Social Security numbers               |
| `CC`        | Credit card numbers (checksum-validated) |
| `MRN`       | Medical record numbers                   |
| `DOB`       | Dates of birth (contextual)              |
| `ACCOUNT`   | Account numbers                          |
| `URL`       | URLs                                     |
| `DATE`      | Dates                                    |
| `SECRET`    | Secrets / credentials                    |

By default a proxy redacts everything the pipeline detects. On Pro and above you can narrow this with a [custom redaction policy](/ai-gateway/proxies-and-policies.md#custom-redaction-policies-pro).

### Endpoints at a glance

| Endpoint                       | Method | API key scope     | Purpose                                     |
| ------------------------------ | ------ | ----------------- | ------------------------------------------- |
| `/api/redact/chat/completions` | POST   | `redact:proxy`    | The redaction proxy (billable)              |
| `/api/redact/run`              | POST   | `redact:run`      | Redact text without forwarding (not billed) |
| `/api/redact/log`              | GET    | `redact:log`      | Redaction audit log for your API key        |
| `/api/redact/attest`           | GET    | `redact:run`      | Enclave attestation summary (Enterprise)    |
| `/api/proxies` (+ `/test`)     | CRUD   | dashboard session | Manage upstream proxy configurations        |
| `/api/usage` (+ `/export`)     | GET    | dashboard session | Usage insights and audit CSV export         |
| `/api/pii/*`                   | varies | `pii:*`           | Encrypted PII vault with consent + audit    |

### Features by plan

| Feature                                | Pro | Enterprise |
| -------------------------------------- | :-: | :--------: |
| Redaction proxies                      |  ✅  |      ✅     |
| Custom redaction policies              |  ✅  |      ✅     |
| Multiple upstream providers            |  ✅  |      ✅     |
| Usage insights                         |  ✅  |      ✅     |
| Audit log export                       |  ✅  |      ✅     |
| TEE redaction + hardware attestation   |  ❌  |      ✅     |
| Enhanced redaction engine (in enclave) |  ❌  |      ✅     |
| Attestation / trust reports            |  ❌  |      ✅     |

The gateway is included with your account; redaction requests draw from your prepaid credits like any other model usage. See [Plans & Pricing](/ai-gateway/plans-and-pricing.md).

### In this section

* [Quickstart](/ai-gateway/quickstart.md) — first redacted request in five minutes
* [Proxies & Policies](/ai-gateway/proxies-and-policies.md) — upstream providers and redaction policies
* [PII Vault](/ai-gateway/pii-vault.md) — encrypted PII storage with consent and audit APIs
* [Attestation](/ai-gateway/attestation.md) — TEE-attested redaction (Enterprise)
* [Usage & Billing](/ai-gateway/usage-and-billing.md) — usage insights, audit export, and how requests are counted
* [Plans & Pricing](/ai-gateway/plans-and-pricing.md) — tiers, metering, and billing