security · 1 min read
BYOK: Bring Your Own Provider Keys Securely
Enterprise customers want their LLM bill on their own provider account. BYOK lets them - without giving Bhogar AI access to their keys at rest.
BABhogar AI TeamProduct & Engineering
Larger customers want their LLM spend on their own provider invoice for procurement, contracting and tax reasons. BYOK gives them that without compromising platform security.
Why it matters
The challenge is custody: the gateway must use the customer key without storing it in a way platform staff could access. The answer is per-tenant KMS-encrypted secrets with envelope decryption per call.
How Bhogar AI approaches it
Bhogar AI gateway supports BYOK with customer-managed KMS, per-tenant secret isolation and audit logs of every key use. Keys never appear in logs, traces or backups.
- Customer-managed KMS for key encryption
- Per-tenant secret isolation
- Per-call envelope decryption (keys never at rest in plaintext)
- Audit log per key use
- Optional key rotation policies
What you get
Enterprise customers ship Bhogar AI in regulated environments with their own LLM accounting and compliance posture intact.