Control plane

See every prompt
heading abroad.
Stop the ones that count.

You deployed private AI, or you’re about to. The gateway finds who still hits chat.openai.com with customer data and gives you enforce mode when leadership is ready.

$ corvux gateway tail --mode observe

EXAMPLE sample data, outside production
DEST api.openai.com · BLOCKED (policy)
ACTION redirect → your Kenya endpoint
ROUTE desk you name · after we see the logs
DEST claude.ai · LOGGED · allow (non-PII tier)
✓ event count is yours after go-live

Private ChatGPT launches Monday. Tuesday someone in credit ops still pastes loan applications into the browser tab they’ve used for two years. You don’t have a visibility problem, you have an enforcement gap.

The AI gateway sits on your network path: log foreign LLM domains, classify risk by data patterns, block or redirect to your private endpoint. Observe mode first; enforce when the board says so.

Observe
Then enforce
Log
Every attempt
Redirect
To private API
KE
Gateway host

Deployment modes

Crawl, walk, block.

01
Discover
30-day observe: who, which tools, rough volume, feeds audit backlog.
02
Classify
Tag flows: sanctioned Azure tenant vs shadow personal ChatGPT.
03
Redirect
Same UX, private backend, staff barely notice the swap.
04
Enforce
Hard block on high-risk destinations; exceptions via ticket + time box.

What gets caught

Shadow AI has a short list of favourites.

Browser UIs

ChatGPT, Claude, Gemini, Copilot consumer, the paste-and-pray crowd.

API keys in code

Scripts calling openai.com from CI or laptops, surfaced in logs.

Zapier / Make

No-code flows shipping CRM rows to foreign automations.

Approved paths

Allow your Nairobi API and blessed Azure, block the rest.

A typical first job we scope: run the gateway in observe mode, list which desks still hit a public LLM, then turn on redirect for those routes. We skip inventing a bank, a day-count, or a drop percentage.

Start with KDPA AI audit if you don’t know what to block yet. Pair with compliance monitoring for ongoing policy drift.

FAQ

CISO and network team.

Proxy vs browser extension?

Both paths exist. Network proxy catches API calls and many web flows; extension adds visibility on unmanaged devices, scoped in the audit.

Will it break developer workflows?

Allow-lists for approved endpoints (your private API, sanctioned Azure tenant). Block mode is phased, observe first, enforce when ready.

How does this relate to the KDPA audit?

Gateway is the enforcement layer after audit findings, inventory becomes policy.

On-prem or cloud gateway?

Kenya-hosted appliance or VM in your DMZ, traffic metadata stays local; block lists update on your schedule.

Start in observe mode

Two-week shadow-AI report, no blocking until you’ve seen the numbers.

Request gateway deployment