Question 1

Is the private gateway generally available?

Accepted Answer

Yes, on AI Growth, Platform Growth, and Enterprise plans. It runs as a self-sufficient gateway in your VPC, sharing the same policy and telemetry engine as the hosted gateway, with signed policy snapshots and locally held budget shares so enforcement keeps working even during control-plane connectivity gaps.

Question 2

Do provider credentials leave our environment?

Accepted Answer

No. For private edge gateway deployments, plaintext provider credentials stay locally encrypted in the customer environment while usage metadata and policy state sync to the control plane.

Question 3

Does every request depend on your cloud being reachable?

Accepted Answer

No. Guardrail checks, policy decisions, and budget enforcement all run locally, so enforcement doesn't pause if connectivity back to Cloptima is briefly unavailable.

Question 4

How do several edge gateways share one budget?

Accepted Answer

Each edge gateway holds a share of a policy's remaining budget for the current UTC day, also counted toward the org-wide ceiling. It admits requests against its share locally, reports what it spent about every 30 seconds, and asks for more before the share runs low. Cloptima sizes each share from the room left in the budget and never grants more than that room, so the cloud gateway and every edge together stay within the budget. There is nothing to configure: set the budget on the policy, and the shares follow.

Question 5

What if an edge cannot reach Cloptima when its share runs out?

Accepted Answer

Once the edge has lost contact with Cloptima, the policy setting "Keep serving if an edge gateway loses contact with Cloptima" decides. On, the default, the edge keeps serving for up to 24 hours, counts the spend locally, and applies it to your budgets when the connection returns. Off, it refuses requests that need more budget until the connection returns. The edge treats contact as lost only when it cannot reach Cloptima and would otherwise soon stop serving: its signed policy expires within 5 minutes, or a budget share has less than a quarter left. Until then, short failures are normal and the policy's fail mode decides.

Question 6

Does this replace provider networking controls?

Accepted Answer

No. It complements your existing network, identity, and provider controls with AI FinOps policy and reporting.

Question 7

Do you integrate with Vault, KMS, or our secrets manager?

Accepted Answer

BYOK credentials are delivered through standard Kubernetes Secrets, so you can back them with whatever secrets manager you already run — Vault, a cloud KMS, or otherwise — via your existing tooling (an External Secrets Operator setup, for example). Cloptima doesn't require a specific secrets backend.

Capability	Cloud Gateway	Private Edge Gateway
Guardrail enforcement	Included	Runs locally in your VPC
Budget & policy decisions	Included	Runs locally in your VPC
Shared budgets & org-wide ceiling	Included	Enforced locally from a share of the same budget
Audit logging	Included	Generated locally, synced for reporting
Provider credentials	Managed by Cloptima	Stay locally encrypted in your environment
Exact response cache	Included	Included
Semantic response cache & search	Included	Included, runs locally (optional)
Deployment model	Hosted SaaS	Runs inside your VPC or on-prem

The Same Governance Engine, Running Inside Your VPC

Some traffic can't leave the VPC

The same engine, running on-site

Start hosted, graduate to private

Self-sufficient by design

Cloud Gateway vs. Private Edge Gateway

Launch path

How the Cloptima gateway compares

Cloptima vs LiteLLM

Cloptima vs Portkey

Cloptima vs Cloudflare AI Gateway

Cloptima vs Helicone

Questions teams ask

Put your first governed call through in five minutes