Comparison
Gateco vs Onyx
Onyx (formerly Danswer) is an open-source, end-to-end enterprise AI workspace: application, connectors, agents and permission sync in one deployable product. Gateco is the authorization layer for the retrieval stack you build yourself. Different lanes, one overlapping question: who should hold the keys to your knowledge.
Bottom line
If you want an internal assistant out of the box, with connectors and permissions bundled, Onyx is a good one and you should evaluate it. If you have already built your own retrieval, agent or customer-facing product, Onyx is not in that conversation: what you need is the authorization layer, and that is Gateco. Policy evaluated on every query, deny-by-default, an audit trail per retrieval, above the vector databases you already run.
| Capability | Gateco | Onyx |
|---|---|---|
| Product category Onyx bundles chat UI, agents and connectors; Gateco is middleware for the stack you build | Authorization layer | AI workspace |
| Works above your own vector databases Onyx retrieves from its own index; Gateco has 12 native vector DB connectors | Yes | No |
| Ships an end-user assistant out of the box Gateco ships no application, by design | No | Yes |
| Open source | No | Yes |
| Policy evaluated at retrieval time, per query Onyx applies permissions synced into its index; changes propagate on resync | Yes | No |
| Fine-grained RBAC / ABAC / ReBAC policy conditions Onyx inherits source-system permissions; Gateco policies are authored and versioned by your security team | Yes | No |
| Deny-by-default and fail-closed on evaluation error No policy means no access; an evaluation error denies rather than serving content | Yes | No |
| Audit trail per retrieval (principal + resource + policy) | Yes | No |
| Bring your own embedding model and pipeline Onyx manages indexing inside its deployment | Yes | partial |
| Python + TypeScript SDK for your own application Onyx exposes APIs for its workspace; Gateco is consumed as a library from code you own | Yes | No |
| MCP server (Claude Desktop, Cursor) Available on every Gateco plan with a retrieve-scoped API key | Yes | Yes |
| Scoped machine credentials (retrieval is an explicit opt-in) | Yes | No |
| Self-host / on-premises Onyx self-hosting is mature, including offline installs. If self-hosting is a hard requirement today, Onyx fits and we would tell you so | roadmap (Q3 2026) | Yes |
| SOC 2 Type II | In progress (H2 2026) | Cloud offering only |
| Public pricing Onyx is free to self-host; cloud and enterprise tiers are contact sales | Yes | partial |
An application versus an authorization layer
Onyx gives an enterprise a finished thing: a chat interface, agents, connectors into workplace tools, and permission sync, all deployable on infrastructure you control. Its permission-aware retrieval is a feature of that bundled product, and it works by syncing access rules from source systems into the Onyx index.
Gateco starts from the opposite assumption: you already have vector databases, an embedding pipeline, and an application of your own. Adopting an assistant does not help you there. What you need is enforcement between your application and your data: policies your security team authors and versions, evaluated on every retrieval against the current principal record, with deny-by-default when nothing grants access and a per-retrieval audit record of who asked, what matched, and which policy decided.
Synced permissions versus live evaluation
The architectural difference with teeth is when access is decided. Permissions synced into an index are correct as of the last sync; identity changes propagate when connectors run again. Gateco decides at retrieval time: deactivate a principal and the next query is denied, with no resync in between. Policy changes take effect on activation, and a policy evaluation error denies rather than serving content. For regulated data, when the decision happens is as important as what the decision is.
The honest trade in the other direction is deployment. Onyx self-hosting is mature, including offline installs, and Gateco today is a managed service with self-hosting on the roadmap for Q3 2026. If running everything inside your own network is a hard requirement right now, Onyx fits that constraint and we would tell you so.
Building your own retrieval?
Free plan available. Add a user, define one policy, and see your first denied retrieval in minutes. No identity provider sync required on any plan.