# What security reviewers ask about AI gateways

URL: https://infro.io/blog/ai-vendor-security-review-questions
Author: INFRO Editorial (https://infro.io/blog/editorial)
Publisher: INFRO
Published: 2026-09-29
Last modified: 2026-10-06
Last reviewed: 2026-09-29 (next review due 2026-10-29)
Topic: Security and governance
Format: Checklist

> Security reviewers of an AI gateway ask about the data flow and subprocessors, how provider credentials are stored, whether content is captured and for how long, identity and audit controls, tenant isolation, certifications and testing, availability and residency, and AI-specific risks. Good answers name a mechanism you can test or a contract clause you can enforce, and admit gaps plainly.

An AI gateway gets a harder security review than most software a company buys, and it should. It sits in the path of every model call, holds the credentials for the organization's provider accounts, and can see every prompt that passes through. The review is also newer than most: the Cloud Security Alliance's CAIQ describes itself as a set of yes/no questions for documenting the controls in cloud services[1], but it was not written with model traffic in mind, so reviewers add their own questions on top.

This checklist collects those questions by domain. For each, it says what a strong answer contains and what should make a reviewer probe further. It is written for both sides of the table: reviewers can use it as a question set, and vendors can use it to find the answers they cannot yet give.

[Diagram: The order a review usually runs in. Probing comes before weighing: a claim you can test yourself is worth more than one you can only read.]

## Data flow and subprocessors

Everything else depends on knowing where data goes. Under the GDPR a controller may use only processors providing sufficient guarantees of appropriate measures, and a processor may not engage another processor without the controller's prior authorization, with notice of changes and a chance to object[2].

- [ ] Which requests pass through the gateway, and which data does it store about each?
- [ ] Which infrastructure vendors process that data, where, and with how much notice before a new one is added?
- [ ] Are the AI providers the vendor's subprocessors, or the customer's own providers under the customer's own agreements?
- [ ] Do retries and fallbacks send the same input to additional providers, and are those listed?

A strong answer is a named subprocessor list stating what each vendor can see and where it runs, plus a data-flow statement that includes fallback targets. A red flag is a residency claim that a single request could falsify — for example, a regional hostname in front of processing that is not actually region-constrained.

## Credentials

- [ ] How are provider credentials encrypted at rest, under which key, and where does that key live?
- [ ] Can a stored credential be displayed again, by the customer or by the vendor's staff?
- [ ] What prevents a sealed credential being moved to another tenant's record?
- [ ] How are the vendor's own API keys stored, and how fast does revocation take effect?
- [ ] Can the encryption key be rotated, and what happens to stored credentials when it is?

Good answers name the algorithm and the key's location, and say that no interface returns a stored secret. Article 32 of the GDPR lists encryption among the appropriate measures for security of processing[3]; the useful follow-up is what the encryption is bound to. See [BYOK gateway architecture](https://infro.io/blog/byok-credential-architecture) for the design detail.

## Content capture and retention

- [ ] Are prompts and completions stored by default? On which plan, if any, is capture on by default?
- [ ] What retention windows exist, and is expired content deleted or only hidden?
- [ ] Who can read captured content — which customer roles, and which vendor staff?
- [ ] Do exports and telemetry ever include content?
- [ ] Does the vendor train on customer content, and where is that commitment enforceable?

A strong answer separates metadata from content, says capture is off by default, and points to the clause in the terms or DPA that carries the no-training commitment, since that commitment is a policy rather than a mechanism. See [the logging policy checklist](https://infro.io/blog/llm-prompt-logging-policy).

## Identity, access and audit

- [ ] Is multi-factor authentication available to customer users, and can an organization require it?
- [ ] Is SAML or OIDC single sign-on supported, and does SCIM deprovision leavers?
- [ ] What roles exist, and can a role be scoped to billing, read-only analysis or key management?
- [ ] Are configuration changes audited with actor and timestamp, and can the audit log be altered?
- [ ] How do the vendor's own staff authenticate, and is a second factor required for sensitive actions?

The strongest audit answer describes an enforcement mechanism — rows the database refuses to update or delete — rather than a statement that logs are kept.

## Isolation and platform security

- [ ] Is the service multi-tenant, and is isolation logical or physical?
- [ ] How is the tenant derived for each request — from the session, or from request input?
- [ ] Which security headers are set on the web surfaces, and can the reviewer verify them?
- [ ] Are outbound webhooks signed, and how are signing secrets rotated?

Some of these can be tested in minutes. `curl -I` shows the headers. A revoked key, a denied model and an export that should not contain content can each be tried in a trial account.

[Diagram: Which kind of evidence can answer which question. Only an independent audit speaks to whether controls operate consistently over time.]

## Certifications, testing and incidents

- [ ] Which certifications or attestations are held today, and which are in progress with an engaged auditor?
- [ ] Has an independent penetration test been performed, and when?
- [ ] What is the breach-notification commitment, and in which document is it enforceable?
- [ ] Are incident runbooks written down, and will the vendor walk through one?

A vendor early in its life often cannot show a SOC 2 report. The honest answer says so, says whether an audit firm is engaged, and does not describe a roadmap item as held. A reviewer whose process cannot proceed without a report should treat that as a reason to wait, not something to negotiate around.

## Availability and location

- [ ] Is there a published uptime commitment, and on which plans?
- [ ] Where does processing happen, and is region-constrained processing offered and enforced?
- [ ] Is a self-hosted or single-tenant deployment available?
- [ ] What happens to traffic if the gateway itself is unavailable?

## AI-specific questions

The OWASP Top 10 for LLM Applications 2025 gives reviewers a shared vocabulary for model risks, from prompt injection to unbounded consumption[4], and the NIST AI Risk Management Framework's Govern, Map, Measure and Manage functions give a structure for asking how the vendor manages them[5].

- [ ] Which OWASP LLM risks does the gateway claim to reduce, and by what mechanism?
- [ ] Are content checks classifiers or patterns, and what do they not detect?
- [ ] Can model use be restricted by organization, project and key, including fallback targets?
- [ ] Can spend be capped per key, per project and per end customer?
- [ ] Does using the product make the customer compliant with any regulation? (The correct answer is no.)

## How INFRO answers these questions

INFRO publishes its answers at [/trust](https://infro.io/trust) and as a downloadable [security questionnaire](https://infro.io/security-questionnaire.md) generated from the same source, so the two cannot disagree. The [DPA](https://infro.io/dpa) and the [subprocessor list](https://infro.io/subprocessors) are public.

[Diagram: INFRO's posture as published on its Trust Center on 2026-10-06, including the gaps it lists.]

The short version, as those pages state it:

| Question | INFRO's answer |
| --- | --- |
| SOC 2 or ISO 27001? | Neither is held. An audit firm is engaged for SOC 2, with no observation window scheduled; ISO 27001 is under evaluation with no auditor engaged. |
| Independent penetration test? | No. The security review is an internal self-assessment. |
| Content captured by default? | No. Capture is off by default on every plan; a retention window and a deletion job apply when it is on. |
| Provider credentials? | AES-256-GCM under a key held outside the database, bound to organization and connection, never returned by any interface. |
| Are AI providers subprocessors? | No. They are providers the customer selected and contracts with directly. Infrastructure vendors are listed at /subprocessors, with 30 days' notice before a new one begins processing. |
| Breach notification? | Without undue delay and in any case within 48 hours of becoming aware, per the DPA. |
| Data residency? | Not offered. The gateway runs beside its database in Frankfurt; that is placement, not a residency control. |
| SSO, SCIM, MFA? | SAML/OIDC SSO and SCIM from the Business plan; two-factor, passkeys and an organization-wide 2FA requirement on every plan. |
| Uptime SLA? | None on self-serve plans; a contractual SLA only by agreement. |

Table: Summary of INFRO's published answers, from /trust, /dpa and /subprocessors on 2026-09-29.

## Sources

1. STAR Level 1: Security Questionnaire (CAIQ v4) — Cloud Security Alliance. https://cloudsecurityalliance.org/artifacts/star-level-1-security-questionnaire-caiq-v4 (accessed 2026-09-29)
2. Regulation (EU) 2016/679 (GDPR), Article 28: Processor — European Union (consolidated text via gdpr-info.eu). https://gdpr-info.eu/art-28-gdpr/ (accessed 2026-09-29)
3. Regulation (EU) 2016/679 (GDPR), Article 32: Security of processing — European Union (consolidated text via gdpr-info.eu). https://gdpr-info.eu/art-32-gdpr/ (accessed 2026-09-29)
4. OWASP Top 10 for LLM Applications 2025 — OWASP GenAI Security Project. https://genai.owasp.org/llm-top-10/ (accessed 2026-09-29)
5. AI Risk Management Framework — NIST. https://www.nist.gov/itl/ai-risk-management-framework (accessed 2026-09-29)

## Revision history

- 2026-10-06: Updated the INFRO posture figure to the Trust Center of 2026-10-06: self-hosted and hybrid deployment are now available on an enterprise agreement, and the hosted service's multi-tenancy is the stated gap.