The AI gateway
and agent protection.
Two things, done properly. A gateway every model call runs through. And agent protection: what an agent can call, and who signs off.
The day AI stops answering and starts acting.
Until now, the worst case was a bad answer. An agent queries a database, sends an email, triggers a payment. Helios decides what it is allowed to do.
A booby-trapped ticket, web page or PDF that your agent is about to read. The prompt is clean; the tool output is not.
A support agent that can reach the HR database. Scope drifts with every MCP server plugged in, and nobody decided it should.
An agent stuck in a loop burns a quarterly budget overnight. Neither your APM nor your WAF can see it.
Autonomy, yes.
A blank cheque, no.
Every tool call is evaluated before it runs: who is asking, on which server, to what consequence.
- ✓ MCP inventory: every tool declared, signed and revocable in one click.
- ✓ Per-agent scope: the support agent reads Zendesk, and nothing else.
- ✓ Tool output inspected: treated as hostile input.
- ✓ Human sign-off: on anything irreversible, the agent prepares and a human signs.
- ✓ Per-run ceilings: tokens, steps, duration. Past that, a halt and a SIEM alert.
Two products, not a catalogue.
A gateway for everything that calls a model, protection for everything that acts. Your existing tools already do the rest.
The gateway
One point of passage: everything in is inspected, everything out is logged.
One API for Mistral, Anthropic, Azure, Bedrock, vLLM, Ollama and more, with routing, fallback and caching. Every model is scanned before it enters the catalogue.
50+ inline rules: PII, IBAN, secrets, jailbreak, injection. On the prompt and on tool output alike.
Traces, latency and cost by team or by use case, with no external collection.
Agent protection
An agent calls tools and writes to your systems. That is the surface we constrain.
Inventory, signing, network sandbox and central revocation for the MCP servers your agents can reach.
The full trace of every run, with step, duration and cost ceilings. Immediate halt when one is crossed.
Transfers, deletions, external sends: the agent prepares, a named human signs off. Dual signature available.
Every agent has its own identity and short-lived secrets, never an employee's key. Revocable instantly.
The questions we get asked in architecture review.
What the gateway does when it fails, what it costs when it holds, and who runs it.
Fail-closed by default.
If the gateway cannot arbitrate or log a call, the call does not go out. A team can switch its scope to fail-open; it is then flagged for as long as the switch is on.
One exception, not configurable: irreversible actions stay fail-closed, always.
Three sources, and one number we will not publish.
Three sources of overhead: policy, inline guardrails, the audit log write. Streaming is not buffered, and a call served from cache is faster than going direct.
No milliseconds on this page: we measure the overhead on your traffic during the evaluation, and that number can go in the contract.
Three, and you choose who operates.
- Sovereign SaaS We operate it, in Europe, and in France for regulated scopes.
- Dedicated private cloud We operate an instance that is yours alone, in the region you choose.
- Your infrastructure You operate a containerised stack. We have no access to it, and nothing comes back to us.
Everything your teams actually put into production.
From the first assistant to the first autonomous agent: one control point.
The internal ChatGPT the board wants and the CISO refuses: PII masked, models chosen per population, one bill per team.
The corpus is never copied out of your VPC. Every answer is traced back to the documents that produced it.
Contracts, invoices, claims: at this volume, unit cost decides. Caching, and routing to the cheapest model that holds quality.
High volume and personal data: systematic masking, short retention, a log that stands up to a complaint.
Claude Code, Cursor or Copilot on your repositories: one expiring key per developer, sensitive repositories out of scope.
Here AI stops answering and starts acting: per-agent scope, human sign-off on anything irreversible.
One integration.
All your models, all your tools, all your rules.
Helios speaks the standard OpenAI API. Wire your code in once, then move from Mistral to Claude or an on-premise vLLM without changing a line.
- ✓ OpenAI-compatible: swap
api.openai.comforapi.helios-security.aiand you are done. - ✓ Models, unified: Mistral, Anthropic, Azure, AWS Bedrock, vLLM, Ollama, Qwen, DeepSeek.
- ✓ Declared MCP tools: the agent only sees the scope you grant it.
Full documentation provided at evaluation kickoff.
# 3 lines to move your stack, agents included, onto Helios import os import helios from openai import OpenAI client = OpenAI( base_url="https://api.helios-security.ai/v1", api_key=os.environ["HELIOS_KEY"], default_headers={"x-helios-policy": "finance-strict"}, ) response = client.chat.completions.create( model="mistral-large-latest", # or claude, gpt-4o… messages=[{"role": "user", "content": prompt}], tools=helios.mcp("zendesk-ro", "crm-lecture"), metadata={"agent_id": "support-fr-02"}, ) # → Helios: PII, policy, tool arbitration, routing, audit
Take back control of your AI spend.
Who uses which model, which agent calls which tool, at what cost. The CIO and the DPO finally share one view.
Soft or hard ceiling, alert at 80%, block when exceeded.
Juniors do not get the €3/Mtok models.
Every call and every action signed, exportable to Splunk, Elastic or Sekoia.
Finance, HR, Legal, R&D: each with its own guardrails and models.
Where your data runs, and who can read it.
We hold no operator access to your data. Access exists only for incident response, with your explicit approval, and is itself logged.
Europe, and France for regulated scopes, audit logs included. As sovereign SaaS, dedicated private cloud, or on your infrastructure.
No product telemetry, no usage collection, no training on your prompts, in all three deployment modes.
Every call and every agent action, append-only, timestamped and exportable to your SIEM.
A local model (vLLM, Ollama) keeps your prompts in-house. A remote model receives them by definition; only the providers you configure are called.
No certification logos on this page: Helios Security is not certified ISO 27001, HDS or SecNumCloud to date. The SecNumCloud qualification applies to our hosting environments, not to us. GDPR, the EU AI Act, DORA and NIS2 shape the architecture: those are design choices, not third-party attestations.
You have had this conversation before. I was on the other side of the table.
Ten years in cybersecurity presales, at the vendors already running in your SOC: Sophos, Trend Micro, VMware Carbon Black, Varonis.
Your buying process and your architecture objections: I heard them before I wrote them into a product.
Check on LinkedIn →You pay for the gateway, not for your tokens.
No percentage on your consumption: our invoice does not rise with your usage. Price depends on scope and hosting, and is set after a scoping call.
One use case, on your traffic, over a few weeks.
- Gateway on one scope
- Standard guardrails
- Full audit log
- Latency measured on your traffic
- Engineer-led onboarding
Pillar 1 in production: everything that calls a model runs through it.
- Models & volumes uncapped
- Guardrails · PII · prompt-injection
- SSO/SAML · RBAC · budgets
- Observability & per-team cost
- Fail-closed configurable per scope
- SIEM export
Both pillars, for agents that write to your business systems.
- Everything in Gateway
- MCP control & agent identity
- Action approval & dual signature
- Run trace & kill-switch
- Dedicated private cloud or your infrastructure
- On-call and service commitments negotiated
Put us on the path of a single use case.
One scope, your real traffic, a few weeks. You leave with the latency measured on your side and an audit log your CISO can read, whether you sign or not.