Security

SmartGate is designed for multi-tenant teams connecting untrusted agent loops to production infrastructure. Follow these practices to stay safe.

API keys

• Treat keys like passwords — never commit them to git or embed in client-side code.
• Create separate keys per environment (dev/staging/prod) when possible.
• Rotate keys from Dashboard → API Keys if exposure is suspected; revoke old keys immediately.
• We store only a hashed form of keys, not the raw secret.

Free plans allow up to 2 keys; Pro 10; Teams 30 (Enterprise: custom).

Authentication

• MCP and REST require Authorization: Bearer sk_live_….
• Dashboard access uses Auth.js (magic link + Google OAuth) with session cookies over HTTPS.
• All teams are isolated by teamId — API keys cannot access another team's data.

Activity logs and retention

Audit entries power Dashboard → Activity Logs and Usage Reports. Retention depends on plan:

Logs may include tool names, timestamps, optional correlation IDs, and fetch URLs you requested. See our Privacy Policy.

Rate limits

SmartGate applies plan-based rate limits:

• MCP requests — counted per API key (e.g. Free: 30 req/min per key for Cursor and agent integrations; Free team MCP ceiling 30). Each key on a team has its own MCP allowance; higher tiers also enforce a team-wide MCP ceiling.
• REST write requests — counted per team (create/update/delete operations). Limits scale with plan (Free: 20/min; Enterprise: 600/min). Free is strict fair-use; exceeding plan limits returns HTTP 429.

When you exceed a limit, responses return HTTP 429 with a limit_scope field indicating whether the throttle was mcp_per_key, mcp_team_ceiling, or rest_write_team. Reduce request rate or upgrade for higher limits. Free / Playground is for individual evaluation, not multi-user load; Teams includes a higher shared-workspace ceiling.

Audit headers (optional)

For REST integrations, optional headers (X-SmartGate-Correlation-Id, etc.) help group agent tasks in Logs. Details: MCP Endpoint. Do not put secrets in header values.

Reporting issues

Email support@smartgate.network for security questions or suspected abuse. Include team ID and timestamps when possible.

We do not offer a public bug bounty at this time; responsible disclosure is appreciated.

Compliance notes

• SmartGate processes URLs and tool metadata you submit; you must have rights to that content.
• Enterprise customers may request additional data processing terms — contact support@smartgate.network.

Threat model in one page

SmartGate handles API keys, team-scoped audit records, tool parameters, and memory payloads for gateway traffic. It does not become your host LLM and does not claim to replace your SIEM. Security work here is key hygiene, tenant isolation, least privilege, and retention discipline.

API key hygiene

• Prefer short-lived or rotatable keys per environment (dev/stage/prod).
• Store keys in a secret manager; never commit Connect JSON with live secrets to public repos.
• Revoke keys on offboarding; confirm Activity Logs stop for that key id.
• Use Bearer auth only on HTTPS endpoints (POST /api/mcp and documented REST routes).

Tenant isolation

Audit queries, exports, and memory operations are scoped by eam_id. Do not assume cross-team visibility in the dashboard. If you operate multiple cost centers, use multiple teams rather than one shared key.

Retention and export

Retention days follow the plan catalog. If compliance needs a longer window than your plan provides, upgrade or export on a schedule (Logs). Exports are for your compliance workflows; treat download artifacts as sensitive.

Rate limits as safety valves

Fair-use RPM and gateway caps reduce blast radius from runaway loops. HTTP 429 with limit_scope is an entitlement signal. Combine with smart_budget_guard for budget enforcement (Tools, Token Control).

What we ask customers not to do

Do not paste secrets into smart_memory expecting encryption guarantees beyond product docs. Do not disable audit when running production agents. Do not share OWNER credentials broadly. For vulnerability reports, contact support@smartgate.network with repro steps and impact.

Practical adoption notes

Treat SmartGate as shared infrastructure: one gateway URL, team-scoped keys, and audit on by default. Prefer pipe templates for repeatable research paths so Activity Logs show a coherent chain instead of ad-hoc tool spam. Keep host-model prompts focused on decisions; let Research and Context primitives prepare evidence. When FinOps asks for savings, export Usage Reports alongside the gateway benchmark explanation—never present Est. USD saved as a vendor LLM invoice. When security asks for evidence, export an audit window and show retention tied to the current plan catalog.

If you are migrating from scripts, replace raw HTTP fetch helpers first, then add dedup and compression, then budget guard. If you are migrating from a model gateway mindset, stop expecting chat completions on /api/mcp and wire MCP hosts instead. If you are writing human-facing product copy, lead with Smart Research / Smart Decision outcomes; keep MCP JSON on builder paths. These habits keep the site and the product aligned with the Positioning Bible: intelligence layer between AI and the world, not an LLM proxy.

Related reading

• Overview for the capability map and plan table
• Connect Guide for host JSON and troubleshooting
• Tools Reference for when to search, fetch, compress, or pipe
• Activity Logs for audit, trace, and export
• Pricing for fair-use limits, Gainshare, and plan ceilings
• Token Control, Traffic Customs, and Audit and Compliance for pillar narratives aligned with this docs set

Keep English-first public docs consistent with the Positioning Bible: SmartGate is an MCP-native algorithmic gateway and intelligence layer—not a chatbot, ChatGPT alternative, AI search engine, LLM proxy, or model router. Humans research and decide through Web experiences; agents connect through MCP/API; both share the same runtime primitives and team-scoped governance.

One more operational reminder

Document your team naming scheme, key rotation cadence, and who owns Gainshare questions before you scale agent count. Prefer bounded Playground or single-tool MCP checks when validating Connect JSON. Prefer audited smart_pipe templates for recurring research once the handshake works. Prefer exporting Activity Logs before plan downgrades that shorten retention. These habits cost little and prevent the two failure modes we see most: empty tool lists from incomplete MCP initialize, and missing audit evidence when a reviewer asks what an agent fetched last week.