Sign in Console
Trust CenterEffective October 25, 2026

Gated Trust Center & Zero Trust First Principles

How M6L LLC applies Five Zero Trust First Principles for both human developers and AI coding assistants: screening untrusted inputs in volatile memory, isolating application secrets, requiring zero third-party packages, and guaranteeing fail-open business continuity.

DATA PRIVACY GUARANTEE
Zero Raw Prompt Storage

User messages sent to Gated are evaluated transiently in volatile memory and discarded immediately after a decision is returned. Prompts are never written to disk, never logged, and never used to train AI models.

AVAILABILITY & RELIABILITY
Fail-Open Business Continuity

Gated is built so your application never goes down because of a screening check. If an account reaches its monthly check allowance or a network timeout occurs, requests fail open so legitimate customer traffic continues uninterrupted.

ZERO SUPPLY-CHAIN RISK
Native Fetch & Secret Isolation

Integration uses a 15-line native HTTPS fetch() call with zero third-party packages. Your system prompts, OpenAI/Anthropic keys, and database credentials never leave your server.

ARCHITECTURAL FOUNDATION FOR HUMANS & LLM MODELS

Five Zero Trust First Principles of Gated

  1. Principle 1: Treat Every Incoming Prompt as Untrusted Input: Never pass raw user input directly into a privileged LLM context or tool-calling loop without deterministic pre-screening at the boundary.
  2. Principle 2: Zero Trust Between Customer App and Screening Service (Strict Least-Privilege Data Boundary): The customer's application never shares its system prompt, OpenAI/Anthropic/Supabase API keys, database credentials, or conversation history with Gated. Only the single untrusted user message (input), an anonymous visitor ID (user), and app_id cross the boundary.
  3. Principle 3: Zero Supply-Chain Trust Required (Zero Third-Party Code Execution): Customers never install an opaque third-party npm or pip package that could read process.env or execute arbitrary code inside their runtime. Integration uses only a transparent 15-line native HTTPS fetch() call that the developer and their AI assistant can read in full.
  4. Principle 4: Zero Persistent Trust in Storage (Ephemeral In-Memory Evaluation): Prompts are evaluated in volatile memory in under 1 millisecond and discarded immediately. No raw prompt text is ever written to disk, logged, or used to train models.
  5. Principle 5: Zero Single-Point-of-Failure Risk (Deterministic Fail-Open Continuity): If the network call times out or an account reaches its plan quota, the boundary fails open ({ allow: true }) so legitimate customer traffic is never interrupted.

1. How Gated Handles Your Data

Customers integrate Gated in front of their AI chat endpoints and storefront assistants to stop prompt theft, unauthorized discount requests, off-topic abuse, and oversized input floods before downstream AI provider costs are incurred. Because customer inputs may contain sensitive end-user conversations, Gated separates transient request evaluation from stored operational metrics.

  • In-Memory Evaluation Only: When your application sends an input to Gated for screening, the text is inspected in memory solely to return an allow, flag, or block decision. The text is discarded before the HTTP response finishes.
  • No AI Model Training: M6L LLC does not sell customer inputs, share message contents with third parties, or use customer traffic to train or fine-tune any language model.
  • Anonymized Abuse Attribution: When your application passes an optional user identifier or IP address for rate limiting, Gated converts that value into a one-way cryptographic hash using a tenant-specific secret so repeat abuse can be counted without storing raw personal identifiers.

2. Data Handling & Telemetry Boundaries

The table below lists the exact categories of information retained in your customer console versus information that is never stored by Gated.

Data Category Retained by Gated Never Retained by Gated
End-User Message Content Message character length, estimated token count, and screening verdict (allow, flag, or block). Raw user prompts, chat histories, uploaded documents, or AI model responses.
End-User Identity One-way salted cryptographic hash of the visitor identifier or IP address for rate-limit enforcement. Raw end-user names, email addresses, phone numbers, or unhashed IP addresses.
Security & Savings Metrics Aggregate check counts, threat category totals, processing time, and estimated AI spend prevented. Customer downstream AI provider keys (such as OpenAI or Anthropic keys) or internal application secrets.
Customer Account & Billing Account owner email, application URL, subscription tier, support tickets, and payment status via Stripe. Raw credit card numbers or bank account credentials (handled exclusively by Stripe).

3. Business Continuity & Fail-Open Operation

Security controls should protect your margins without creating a single point of failure for your product. Gated enforces strict fail-open behavior across both our service endpoints and our recommended customer integration snippets:

  • Quota Exhaustion Continuity: Starter trial accounts include 250 free checks. If an account reaches 100% of its monthly check quota before upgrading, Gated continues returning HTTP 200 responses with allow: true and quota_exceeded: true while incrementing your unscreened passthrough counter in the console. Your users are never locked out of your application because of a billing limit.
  • Network Timeout Fallback: Our standard integration snippets include a short client-side timeout so that if your server cannot reach Gated for any reason, your application proceeds with its normal request flow.

4. Infrastructure Categories & Subprocessors

M6L LLC relies on established infrastructure and payment providers to deliver low-latency screening and billing. We evaluate vendors based on security certifications (SOC 2 Type II, ISO 27001, and PCI-DSS Level 1) and data minimization practices.

Service Function Provider Data Processed Security & Compliance Posture
Global Edge Network & DDoS Protection Cloudflare, Inc. (United States / Global) Encrypted HTTP traffic in transit, transient screening requests, and aggregate account telemetry. SOC 2 Type II, ISO 27001:2022, TLS 1.3 encryption in transit, anycast DDoS mitigation.
Subscription Billing & Payment Processing Stripe, Inc. (United States) Customer billing email, subscription plan selection, payment card details, and invoice history. PCI-DSS Level 1 Service Provider, SOC 1 & SOC 2 Type II.
Transactional Email Delivery Resend, Inc. (United States) Account owner email address for verification links and service notifications. TLS encryption in transit, DKIM/SPF/DMARC authenticated delivery.

5. Security Contact & Vulnerability Disclosure

M6L LLC welcomes reports from independent security researchers, customers, and partners. If you believe you have discovered a security vulnerability or privacy issue in Gated, please contact us directly:

We acknowledge receipt of vulnerability reports within one business day and work with reporters to verify and remediate valid findings promptly.

6. Legal Agreements & Policies