Your AI should only know
what it's allowed to know
Your AI agents bypass every access control you built
You invested in SSO, IAM, ACLs, and RBAC for every system in your organization. Then you deployed RAG, and created a new access surface that bypasses all of it. Vector databases retrieve by semantic similarity, not authorization. When your AI copilot is asked about compensation data, it returns the most relevant chunks, not the most appropriately authorized ones. This is the RAG authorization gap.
You should not have to choose between shipping AI and protecting the data it reads.
Permission-aware retrieval, enforced on every query
Gateco sits between your AI agents and vector databases, enforcing policies at retrieval time without changing your existing architecture.
Deny-by-Default Retrieval
Your AI agents can only access data they're explicitly authorized for. No policy match, no data, eliminating the #1 cause of RAG data leakage.
Instant Policy Changes
Policies are evaluated at query time, not baked in at ingestion. Reclassify a document or restrict a group and it applies to the very next retrieval: no re-embedding, no re-indexing, no stale permission cache.
Access Simulator
Dry-run a policy against any principal before it goes live, or run a live preview against real data. See exactly who would be allowed and who would be denied, with no deployment risk.
Full Audit Trail
Answer "who accessed what through AI, and when?" instantly. Every retrieval decision recorded with the exact policy logic, audit-ready from day one.
Also included
12 Vector DB Connectors
Layer onto what you run. No migration, no lock-in.
Semantic Readiness (L0-L4)
Track each connector's path to full policy enforcement.
Identity Provider Sync
Principals and groups from Okta, Entra ID, AWS, or GCP.
Grounded Answers
Cited answers built only from policy-allowed chunks.
Multi-Mode Search
Vector, keyword, hybrid, and grep in one API.
Policy Templates
Seven ready-made templates for common access patterns.
Classification Suggestions
Scan resources and get suggested labels to review.
SDK + CLI
Python and TypeScript SDKs, plus an operations CLI.
SCIM Provisioning
Inbound SCIM v2 for real-time user and group sync.
MCP Server
Permission-aware retrieval for Claude, Cursor, and agents.
Five questions buyers ask
What about latency?
21ms p95 measured policy-layer overhead on the published benchmark. Methodology is public and the benchmark ships with the backend.
See the SLO →What about pgvector RLS?
Works until you need an audit trail, IDP sync, or a second vector DB.
Read the comparison →What about Cerbos?
Cerbos is engine-shaped. Gateco is RAG-specific and ships with 12 connectors.
Read the comparison →Won't Microsoft bundle this?
Purview secures M365 Copilot. Gateco secures the AI you ship in your own product.
See the difference →What if you're unavailable?
Fail-closed by default. Every error-time denial is logged. No ambiguous access.
Read the failure model →Works with your stack
Connect your vector databases and identity providers in minutes
Vector Databases
Identity Providers
Three steps to secure retrieval
No infrastructure changes required. Connect, configure, and enforce, and your AI agents keep working, now with permission boundaries.
Secure Retrieval
Every query is permission-checked
Step 3
Demo track
Connect and make your first policy-filtered retrieval call in minutes.
Point Gateco at a vector DB, define one policy, and retrieve. No IDP sync required.
Production track
Full governance deployment: connector, search config, resource registration, IDP sync, policy authoring, and Access Simulator validation.
Median time to L3 readiness: ~2 weeks. Full deployment guide →
Integrate in minutes
Python and TypeScript SDKs make permission-aware retrieval a one-liner. The CLI handles everything else.
from gateco_sdk import GatecoClient
client = GatecoClient(api_key="gck_...")
# Deny-by-default retrieval
result = client.retrievals.execute(
query="quarterly revenue forecast",
principal_id="user-uuid",
connector_id="connector-uuid",
search_mode="hybrid",
)
# Returns only what this principal is authorized to seeWhat our design partners tell us
Feedback from teams building on Gateco in regulated industries. Quotes are shared with permission and kept anonymous under NDA.
Senior ML Engineer
Financial Services
We needed ABAC on our RAG pipeline before shipping to customers. Gateco got us there in a day, not a quarter.
VP of Engineering
Healthcare Tech
The audit trail alone justified the cost. Every retrieval decision is logged with the exact policy reason, and compliance teams love it.
AI Platform Lead
Enterprise SaaS
Deny-by-default was the feature that sold us. Our previous setup was allow-unless-explicitly-denied. That's backward for sensitive data.
Staff Software Engineer
Legal Tech
Connecting to our existing pgvector setup took 15 minutes. Policy configuration took another hour. We were in production the same day.
Head of Data & AI
InsurTech
The Access Simulator let us test policies before enforcing them. No other tool we evaluated had this. It removed all the deployment risk.
Simple, transparent pricing
Start free, scale as your AI retrieval needs grow.
Team
$499
per month
- 3 connectors
- 50,000 retrievals/mo
- ABAC + ReBAC policies
- Grounded Answers
- Priority support
Growth
$1,999
per month
- 10 connectors
- 500,000 retrievals/mo
- SSO & SCIM
- Access Simulator
- Audit export
Enterprise
from $24K
per year
- Unlimited everything
- SIEM integration
- Private Data Plane
- Custom SLAs
Free tier available with no credit card required. 1,000 retrievals/mo.
Start securing your AI retrieval today
Free tier available. No credit card required. Connect your first vector DB in minutes, and reach production-grade governance with our structured deployment path.