02 · Product
One door for all model traffic.
The Masbando Machine Intelligence Gateway sits between your people and applications and the AI models they use: frontier APIs, local models, embeddings, speech. Standard APIs in, governed model calls out.
Security first, then ease of use, then performance. Written in Rust. Runs on your premises, with or without internet.
Why
What goes wrong without one.
AI does not arrive in a company as one project. It arrives as a chat licence in one team, a coding assistant in another, a feature in the CRM, a script with an API key. Six applications and five providers can mean thirty point-to-point connections, each a key, a contract, a log in another console and an invoice.
Data leaves unseen
Prompts go to providers nobody approved, with whatever the user pasted.
- 223 incidents of sensitive data sent to AI apps per company and month (Netskope, 2026)
- Most often source code: 42 %
Keys in the wrong places
API keys in scripts, repositories and configuration files, one per tool and team.
- 1.28 million AI service keys leaked on public GitHub in 2025, up 81 % (GitGuardian)
- A stolen key is spent by someone else, at your expense
Bills without an owner
Agents and scripts spend without a limit; the invoice arrives a month later, for the whole company.
- OWASP 2026: unbounded consumption up from rank 10 to rank 6
- One hour of a coding agent: $14.36 (our own measurement)
No answer for the auditor
Which AI, which data, which provider, which person: nobody can say for the last quarter.
- FINMA: institutions had “difficulties determining whether AI is included, which data and methods are used”
- EU AI Act: deployers of high-risk systems keep logs for at least six months
How
One request through the gateway.
The same argument as for the mail gateway or the web proxy every company already has: one door, one set of rules, one log. Inside, every request becomes one provider-neutral model, so routing, policy and logging do not care which API dialect came in.
Returns
What it pays back.
Cost, data protection, compliance, freedom of choice, and faster adoption: one approved door instead of a review per tool and team.
- Cost
- The right model per requestRouting by complexity, caches kept warm, answer length capped, automatic downgrade when a budget runs out.
- Data
- The data class decides the routeRestricted data stays on site; names are masked before external models and restored in the answer.
- Proof
- Provable for every requestWho used which model with which data: tiered, encrypted logs and evidence packs for FINMA, GDPR and the AI Act.
- Choice
- Change the model, not the codeApplications call a stable alias. When a model is retired or a better one appears, one line changes.
Capabilities
What it does.
Twelve capabilities, each a module behind a stable interface that can be added, replaced or compiled out.
Standard APIs in, any model out
The OpenAI API, Anthropic's Messages API and MCP on the way in; OpenAI, Azure, Anthropic, Google, AWS Bedrock, Mistral, vLLM, llama.cpp and Ollama on the way out. Existing SDKs and tools keep working.
Identity from your directory
OIDC and OAuth 2.0, LDAP and Active Directory, API keys bound to a project, mTLS for services. Authorisation by roles, groups and attributes, deny by default, every decision explainable.
Routing as a graph, stored as text
Classify, check policy and budget, anonymise, pick a model, fall back. Edited graphically or as text, kept as reviewable YAML in Git, tried in a dry run before activation.
The data class decides the route
Restricted data stays on your own models. Confidential data goes to a Swiss or EU provider, or to a frontier model only with names masked and restored in the answer, streaming included.
Budgets that act
Costs mapped to departments, projects and people, with warnings and automatic actions: downgrade to a cheaper model, ask for approval, block. Every franc with an owner.
Logs in four tiers, keys decide who reads
Identity, classification and content are separate tiers, each encrypted for the roles that may see it. A tamper-evident audit chain records every change, kept ten years by default.
Tools and knowledge, governed
MCP and WebMCP with per-tool authorisation and per-user credentials, retrieval on PostgreSQL that respects the permissions documents already have, web search, voice, skills.
Cross-checked answers
For high-stakes requests several independent models answer and a comparator reports a calibrated confidence, or one model answers and another verifies. An unchecked answer is never presented as checked.
Evidence before change
Shadow and A/B routing against golden test suites and a local judge, drift monitoring after a change, right-sizing recommendations where an expensive model answered simple requests.
Backups you can restore
Encrypted, signed backups to S3-compatible storage with offline recipient keys, object lock, automatic restore drills, and the root key split among custodians.
Two user interfaces, strictly apart
A management UI with an executive overview and a technical console, on its own listener and hostname; a built-in chat UI for everyone else. The public listener has no admin routes at all.
Runs anywhere, also offline
One binary for Kubernetes, OpenShift, Docker Compose or bare metal; amd64 and arm64; Linux, macOS, BSD. Fully offline with local models. PostgreSQL is the only required infrastructure.
Trust
Built to be a hard target.
A gateway sees every prompt. That is why its own security comes before its features, and why the protections are cryptographic rather than cosmetic: hiding something in the user interface is not the same as nobody having the key.
Separate doors
Management UI and admin API on their own listener and hostname, with separate sign-in, sessions and MFA for administrators.
Memory-safe, few parts
Written in Rust with unsafe code forbidden outside audited libraries. Every dependency justified, licence- and vulnerability-checked; all parsers fuzzed.
Signed and traceable
Every release signed, with a software bill of materials. Offline update bundles are verified against a key built into the binary.
Secure defaults
No default passwords, a one-time bootstrap token, tools off until granted, remote access off, containers non-root with a read-only file system.
Compliance
Compliance as configuration.
Regulations change what the gateway must do: retain, log, block, ask, prove. Compliance profiles are versioned configuration objects that set defaults and hard constraints. A configuration that breaks an active profile is not activated.
Evidence packs per profile and quarter, signed. Legal interpretation is confirmed with your counsel per customer.
- ch-fadp
- Swiss Federal Act on Data Protection (revFADP)
- ch-finma
- Swiss banks, insurers and asset managers: banking secrecy, FINMA circulars and guidance 08/2024
- eu-gdpr
- GDPR and BDSG; Liechtenstein via the EEA
- de-bsi-c5
- German cloud computing criteria catalogue
- eu-dora
- EU financial entities: ICT risk, incident reporting, third-party register
- eu-ai-act-deployer
- Deployer duties under the EU AI Act: logging, oversight, disclosure, AI literacy
Also mapped: ISO/IEC 27001, 27701 and 42001, NIS2, GoBD and OR Art. 958f, TISAX. US frameworks (SOC 2, NIST, HIPAA) follow in a later phase.
Licensing
How you get it.
Proprietary software, licensed per installation; all third-party components are permissively licensed. Operated by you, or by Masbando on your premises.
- Licence
- Per installation, with support and signed releases.
- Pilot
- Start small: one team, one provider, one local model, costs visible from day one.
- Operation
- Run it yourself, or let us run it: Managed MMI Gateway.
- Documentation
- Architecture document and requirements available under NDA.
Contact
Talk about a pilot.
Tell us which data classes, which providers and which applications you have today. We say what a first installation would look like.
- Phone
- +41 44 244 90 40
- info@masbando.com
- Office
- Masbando GmbH, Zurich