Gateco
Gateco provides a permission-aware retrieval layer that sits between AI agents and vector databases, enforcing access policies on every RAG query. The platform adds a measured 21ms p95 policy-layer overhead per query and operates fail-closed by default, ensuring AI systems only return data users are explicitly authorized to see. It supports 12 vector database connectors including pgvector, Pinecone, and Qdrant.
- Cybersecurity
- Developer Tools
- Artificial Intelligence
- Enterprise Software
- Software Only
Funding
Founders
Founder details are not available yet.
Product
Problem
Organizations invest heavily in SSO, IAM, ACLs, and RBAC for their systems, but deploying RAG creates a new access surface that bypasses all of it. Vector databases retrieve by semantic similarity, not authorization, so AI agents may return sensitive data chunks regardless of the requester's permissions. This is the RAG authorization gap, forcing companies to choose between shipping AI and protecting the data it reads.
Solution
Gateco sits between AI agents and vector databases, enforcing permission-aware retrieval at query time without changing existing architecture. It adds a measured 21ms p95 policy-layer overhead per query and operates fail-closed by default, denying access on any error rather than allowing silent pass-through. Policies are evaluated at query time, so reclassifying a document or restricting a group applies to the very next retrieval without re-embedding, re-indexing, or stale permission caches. The platform includes an access simulator for dry-running policies and a full audit trail that records every retrieval decision with exact policy logic.
Target Audience
Primary customers are engineering teams deploying AI agents in regulated environments including financial services, healthcare, and SaaS platforms with enterprise customers, who need permission-aware retrieval to protect sensitive data accessed through RAG systems.
Features
- Deny-by-default retrieval: AI agents can only access data they're explicitly authorized for; no policy match means no data
- Query-time policy evaluation enabling instant policy changes with no re-embedding or re-indexing
- Access Simulator for dry-running policies against principals before go-live, with live preview against real data
- Full audit trail recording every retrieval decision with exact policy logic, audit-ready
- 12 vector DB connectors across Tier 1 (pgvector, Supabase, Neon, Pinecone, Qdrant) and Tier 2 (OpenSearch, Weaviate, Milvus, Chroma, Azure AI Search, Vertex AI Vector Search, Vertex AI Search)
- Multiple search modes: vector, keyword, hybrid, and grep for literal substring/regex scans
- Metadata resolution modes: sidecar, inline, and sql_view for flexible policy-relevant metadata handling
- Classification suggestions with automatic scanning and rule-based recommendations for resources
- Fail-closed by default with per-connector circuit breaker and optional fail-open only on Enterprise via signed agreement
- SOC 2 Type II audit underway, HIPAA BAA on roadmap, GDPR data residency support, AES-256 encryption at rest and TLS 1.3 in transit