AI governance without
someone else’s edge.
Cloudflare’s edge is not acceptable for your workloads. Data has to stay in this VPC, this region, or this air-gapped cluster. You still need agent identity, machine payments, and AI governance. SBproxy runs where governance has to live.
# In-VPC deployment with internal CA + on-prem audit sink
proxy:
http_bind_port: 8080
https_bind_port: 8443
tls:
ca_bundle: /etc/ssl/internal-ca.pem
cert_dir: /var/lib/sbproxy/certs
observability:
metrics:
prometheus: {port: 9090}
audit:
sink: syslog
target: audit.internal:6514
vault:
backend: hashicorp_vault
address: https://vault.internal:8200
origins:
"api.internal":
action:
type: proxy
url: https://backend.internal:8443The problem we hear.
Some traffic is not allowed to terminate at someone else’s edge. Public sector procurement, defense contracts, EU data residency, and healthcare workloads all draw the same line. The vendor gateways drawing AI traffic are SaaS-only.
SBproxy is the gateway the in-VPC vendors do not ship and the SaaS vendors cannot run. Single binary, K8s operator, air-gapped install. Same policy graph in every shape.
When you put SBproxy in front of your stack.
The work below moves out of the engineering backlog and into a config change.
- Run AI governance where your data lives. Not at someone else's edge.
- Ship the same policy graph in cloud, on-prem, and air-gapped clusters.
- Bring your own Stripe, SSO, observability, and audit sink. No vendor lock.
- Hand your security team the source. They can read every line before approval.
What’s shipping in the data plane.
For engineers in the buying committee. The capabilities behind the outcomes above.
- 01One binary, anywhereSingle static executable. Drop it on a server, point it at a config, route real traffic. No phone-home, no license call-out.
- 02Kubernetes-native at scaleCRD-driven operator reconciles policy, certificates, and origins across the fleet. Helm chart included.
- 03Sealed for sovereign networksAir-gapped install with no required external services. Approved for defense, public sector, and regulated workloads.
- 04Connect to what you already runYour Stripe. Your SSO. Your observability stack. Your audit sink. Your CA. Nothing forces you onto a vendor cloud.
- 05Update policy without downtimeHot reload applies in seconds. In-flight requests finish under the previous policy. Bad configs are rejected before they go live.
- 06Open source for reviewSource on GitHub at github.com/soapbucket/sbproxy. Your security team can read every line and compile from a tagged commit.
- Your workloads are in EU, India, Saudi Arabia, US public sector, defense, healthcare, or finance.
- Your security team will not approve traffic terminating at someone else’s edge.
- You operate air-gapped clusters and need a real product, not a reference architecture.
Want to talk
before you install?
The gateway is on GitHub under Apache 2.0 and you can install it right now, so nothing here is gated behind a sales call. Use this form for deployment questions, migration scoping, or anything you would rather not file as a public issue.