Documentation

Getting started: integrate Gateco in 9 steps

Gateco is the permission layer between your AI applications and your organization's knowledge. Your vectors stay in your database; Gateco becomes the policy-enforcing gateway your apps query instead of hitting the database directly. Steps 1 through 3 take minutes. Steps 4 through 7 scale with how much data and policy you bring. Step 8 is usually a one-line change in your application.

1

Create your organization and pick a plan

Sign up with email or Google/GitHub SSO. The Free tier is built for evaluation: 1,000 secured retrievals, one connector, and 100 ingested documents per month. Team unlocks batch and async ingestion. Growth adds vendor IAM sync, SCIM provisioning, and source connectors with permission import.

2

Connect your vector database

Your vectors stay in your database. Add a connector for pgvector, Supabase, Neon, Pinecone, or Qdrant to get the full ingestion experience, or Weaviate, Milvus, Chroma, OpenSearch, Azure AI Search, and Vertex AI for search-only governance. Credentials are envelope-encrypted against your organization's KMS binding, and the connection test confirms reachability before anything else depends on it.

3

Configure search

Tell Gateco which table or collection holds your embeddings, plus the embedding, id, and content columns. For Postgres-family connectors the schema introspector detects vector tables and fills this in for you. This step turns the connector from connected into search-ready.

4

Make your data policy-ready

Three routes, and most teams mix them:

  • Existing vectors: run retroactive registration to register unmanaged vectors as gated resources, then apply classification suggestions in bulk. An admin reviews every suggestion before it applies.
  • New documents: ingest through Gateco. Upload files in the UI, use the SDK for single or batch ingestion, or queue async jobs for large corpora (Team and above). Extraction runs self-hosted inside the deployment, so document content never leaves it.
  • Living knowledge bases (Growth and above): connect Google Drive, SharePoint, Confluence, or Notion as a document source. Documents and their permissions sync on a schedule, deletions propagate, and access revocations follow automatically.
5

Connect your identity provider

Sync principals and groups from Okta, Azure Entra ID, AWS IAM Identity Center, or GCP Cloud Identity (Growth and above), or provision users via SCIM. Every retrieval request is evaluated against a real principal, so this is how policies get identities to reason about.

6

Create and activate policies

Start from the seven policy templates or let the suggestion engine propose conservative drafts from your synced groups and classifications. RBAC, ABAC, and relationship-based (ReBAC) conditions are all supported. If you connected a document source, review the auto-generated draft policy and the ACL coverage report. Everything starts as a draft: nothing enforces until you activate it.

7

Simulate before you enforce

The Access Simulator answers the question that matters before go-live: what would this specific person see for this query? Dry runs evaluate policies against synthetic requests, and live preview executes a real retrieval and shows the allowed and denied results side by side.

8

Cut your applications over to Gateco

Create an API key, install the SDK, and replace direct vector database queries in your RAG application with a secured retrieval call:

pip install gateco

from gateco_sdk import GatecoClient

client = GatecoClient(api_key="gck_...")
principal = client.principals.resolve(email="alice@yourco.com")
results = client.retrievals.execute(
    connector_id="...",
    principal_id=principal.id,
    query="Q3 revenue forecast",
)

Grounded Answers adds policy-aware answer synthesis with citations, and the MCP server plugs Gateco into Claude and other AI agents. Then close the loop on the security boundary: restrict direct database access so governed workloads can only reach the data through Gateco.

9

Operate: audit, usage, and sync

Every retrieval is recorded: who asked, what was allowed, what was denied, and which policy decided. Watch the audit log, track usage against plan limits, and let scheduled identity and source syncs keep principals and content fresh.

Evaluate in under an hour

A typical evaluation on the Free tier: connect one database, ingest a handful of documents, write one template policy, and run a simulated retrieval. No credit card required.

Start free