AI gateway for Irish firms: keys, logs and client data

An AI gateway is the server your applications talk to instead of calling OpenAI directly. It holds the API keys, chooses the model, enforces spending limits and keeps a record of each request. For an Irish firm that has started building on large language models, it is usually the piece of infrastructure that appears soon after the prototype.

Nonimo Gateway runs on your own servers. See plans and get in touch.

The question that matters here is what the gateway keeps. If your requests carry client names, PPS numbers or clinical notes, every gateway log is a copy of personal data held for the purposes of the GDPR and the Data Protection Act 2018. Whether you need a private gateway depends on what flows through it, and on who is allowed to read it.

The six jobs of an AI gateway, and what each one keeps

Most products sold as an AI gateway or LLM gateway do some mix of the following. The right-hand column is the part a data protection officer will ask about.

function	what it is for	what it ends up holding
key management	one place for the OpenAI key, so it is not in every app	your provider credentials
routing and fallback	send a request to another model if one fails	nothing extra, in principle
rate and spend limits	stop a runaway script from running up the bill	counts per user or app
caching	answer a repeated question without paying twice	the prompt and the answer
logging and tracing	debug errors, see who used what	often the full prompt and answer
guardrails	block certain content or patterns	depends on the product

The top three rows are plumbing. The bottom three are where the copies of client data accumulate. A cache keyed on the prompt is a store of prompts. A tracing tool that shows you the full conversation is, in data protection terms, another system holding personal data that needs a retention period and access controls.

What a gateway that stores prompts means for personal data

Under Article 5(1)(c) of the GDPR, personal data must be limited to what is necessary for the purpose. A log of every prompt kept indefinitely, because the default was on, is hard to defend against that principle.

The DPC’s guidance on AI and large language models, published in July 2024, asks organisations to understand what personal data an AI system uses and whether inputs are retained or reused, and it calls for a retention schedule so that storage limitation is not breached. A gateway log is one of those places where inputs are retained. It belongs in your record of processing next to the model provider.

Hosted gateways make the logs part of the product. Portkey’s pricing page measures its plans in recorded logs per month, and LiteLLM’s guardrail documentation describes a logging_only mode that scans what gets logged without changing the response the client receives. Neither is a criticism: logging is useful. It does mean the log is a decision your firm makes, not something that happens to you.

Two contracts follow from it. If a company runs the gateway for you and handles the content of your requests, it is a processor, and Article 28 requires a written agreement. The model provider is a second processor with its own agreement and its own retention rules, which our guide to how long ChatGPT keeps your data goes through for OpenAI.

When an Irish firm needs a private AI gateway

A private gateway runs on infrastructure you control: your own AWS or Azure account in an EU region, or a server in the office. You hold the logs, you set the retention, and no third party sits between you and the model provider. Ask these questions before you choose.

1. Do the requests carry personal data? Client correspondence, patient histories, payroll queries and tenancy files nearly always do. Marketing copy and public documents usually do not.
2. Is any of it special category data? Health data at a clinic or a pharmacy, or trade union details in an HR file, raise the bar under Article 9. Our guide to special category data and AI lists what to keep out.
3. Have you promised clients where their data goes? An engagement letter or a privacy notice that names your processors should not be quietly extended to a new one.
4. Would a leaked log be a notifiable breach? If a log of client prompts were exposed, the DPC expects to hear within 72 hours where there is a risk to the people in it. A log you never kept cannot leak.
5. Who needs to read the logs? If the answer is two developers in the firm, there is little reason for them to live with a third party.

If you answer yes to the opening question and to any one of the others, a private gateway is the sensible starting point. If every answer is no, a hosted service may do the job with less to maintain.

Why a private gateway is not enough on its own

A private gateway keeps the logs in your hands. It does not change what reaches the model provider. The prompt still leaves the building with the client’s name and number in it, and it sits in the provider’s own monitoring logs for whatever period its terms allow.

A privacy proxy deals with that second problem. It sits after the gateway and before the provider, replaces personal data with placeholders on the way out, and puts the real values back in the answer on the way in. The chain looks like this:

1. Your application sends the request to the gateway.
2. The gateway applies keys, limits and routing.
3. The privacy proxy replaces names, numbers and addresses with placeholders.
4. The model provider sees placeholders and answers with them.
5. The proxy restores the originals before the answer reaches your application.

The comparisons we have published of LiteLLM’s PII guardrails and of the Cloudflare AI Gateway show how far each gateway goes on the content side, and where an extra layer helps.

A worked example from a Cork accountancy practice

The firm and the client below are invented. A practice in Cork has built an internal tool that drafts replies to Revenue correspondence. A request leaving the gateway reads:

Draft a reply for our client Siobhán Delaney, PPSN 1234567TA, Eircode T12 X4Y9, about her 2025 rental income from the apartment in Douglas.

Through a privacy proxy, the model provider receives:

Draft a reply for our client [PERSON_1], PPSN [ID_1], Eircode [POSTCODE_1], about her 2025 rental income from the apartment in [PLACE_1].

The draft comes back with the placeholders, and the proxy fills them in before the accountant sees it. The PPSN should arguably not be in the prompt at all, since the reply does not need it; our guide on whether a PPSN is personal data explains why minimising comes before anything else. The proxy is for what the task genuinely needs.

Nonimo Gateway, briefly

Nonimo Gateway is a private proxy of this kind. It runs on your own servers or in your own cloud, and the content does not pass through Nonimo. It speaks the OpenAI API, so your code changes its base_url and nothing else. It replaces personal data before the request leaves and restores it in the response. You keep your own OpenAI key, and it is also available as a plugin for LiteLLM if that is the gateway you already run.

Plans and prices are on the Nonimo Gateway page. It helps with pseudonymisation under Articles 25 and 32; it does not replace your contracts, your impact assessment or your judgement about what should be sent at all. The difference between a gateway and a model you host yourself is the subject of our guide to a private LLM or a privacy proxy, and the routes by which data escapes are in how an AI data leak happens.

If your firm already calls an LLM API with client data in the requests, the gateway is the right place to decide what leaves and what is logged. See Nonimo Gateway’s plans and get in touch.

Sources

Checked 20 October 2026.

• Regulation (EU) 2016/679, the GDPR. Article 5(1)(c) on data minimisation; Article 25(1) and Article 32(1)(a) naming pseudonymisation; Article 28 on processors and the contract they require.
• Data Protection Commission, AI, Large Language Models and Data Protection, 18 July 2024. Understanding what personal data an AI system uses and whether inputs are retained; the need for a retention schedule.
• Data Protection Commission, Anonymisation and pseudonymisation. Pseudonymised data is still considered personal data.
• Data Protection Commission, breach notification. Notification within 72 hours of becoming aware of a breach that presents a risk to individuals.
• Portkey, pricing. Plans described in recorded logs per month.
• LiteLLM, guardrails quick start. Guardrail modes including logging_only, which scans logged input and output without changing the client response.