Decide where Portkey runs before you pick a plan, then test every provider route you will send through it. Put keys, budgets, retention, and audit logs on the Enterprise contract, and get Palo Alto Networks' terms for the portkey.ai plans in writing. This checklist covers hosting, route tests, keys and budgets, data retention, security, and the contract.
When you need this
- You are moving model calls from app-held keys to one gateway and security wants every call logged.
- You run the open-source gateway today and need to decide whether to keep it after the acquisition.
- Your Portkey contract renews and Palo Alto Networks now sells the product as Prisma AIRS AI Gateway.
Evaluation criteria
Choose where it runs
Portkey cloud, hybrid, or the open-source gateway?
Look forPortkey cloud needs no infrastructure. The hybrid Enterprise setup runs the data plane in your VPC and keeps LLM traffic there, while Portkey's control plane runs administration, configs, and analytics. The open-source gateway has had no release since v1.15.2 on January 12, 2026, so self-host it only with the /v1/proxy/* route blocked.
Test each provider route
Which provider formats and features will you send through it?
Look forList every model maker, endpoint, and feature you use, such as streaming, tool calls, prompt caching, embeddings, and the Messages and Responses formats. Run real requests through each and compare outputs and usage with the provider's own figures. Practitioners report dropped Gemini system messages, failed Bedrock cache checkpoints, and embedding batches returning a single embedding.
Set keys, budgets, and alerts
Who can spend what, and who is told when?
Look forAdd each model maker's key to the Model Catalog and give teams workspaces and API keys. Cost or token budgets and rate limits on API keys are available on Enterprise and to select Pro customers, so write them into the contract. Alerts on logs start on Production.
Decide what Portkey keeps
How long may request logs live, and where?
Look forLogs are kept 3 days on Developer and 30 days on Production; Enterprise sets custom retention periods and data isolation. Requests past a plan's log limit still run but are not recorded, so count recorded logs against your audit needs.
Check security controls
Can you show who changed what, and who may connect?
Look forAudit logs of admin actions and SSO with Okta and Microsoft are Enterprise features, and role-based access control starts on Production. Portkey states SOC 2, ISO 27001, GDPR, and HIPAA compliance, with custom BAAs on Enterprise, and IP and geography allowlists for its deployments.
Settle the contract
What does Palo Alto Networks commit to?
Look forPalo Alto Networks completed the purchase on May 29, 2026 and made Prisma AIRS AI Gateway generally available on July 16, 2026, while the portkey.ai plans remain on sale. Ask how long current prices and terms last, when contracts move to Prisma AIRS AI Gateway, and which entity signs the DPA.
Questions to ask vendors
- Which provider routes and features have we tested through the gateway, and against which version?
- Do we need the data plane in our VPC, or may request logs live on Portkey cloud?
- Which teams get budgets and rate limits, and are those in our Enterprise terms?
- How long may Portkey keep our request logs, and who can read them?
- What has Palo Alto Networks committed in writing about prices, migration, and support for the open-source gateway?
Red flags
- A self-hosted open-source gateway with the /v1/proxy/* route reachable.
- Streaming in production with no check for answers that end without a finish reason.
- Key budgets assumed on a Production plan that does not include them.
- A renewal signed with no written terms on the move to Prisma AIRS AI Gateway.
- A support path that depends on the bounced support@portkey.ai address.
Products in this piece
Sources
- Official documentation
- 12
- Public source
- 9
- Portkey pricing
- Portkey docs: Hybrid deployment architecture
- Portkey docs: Enterprise offering
- Portkey docs: Audit logs
- Portkey docs: Model Catalog
- Portkey docs: Enforce budget and rate limits for API keys
- Portkey: Security and compliance
- Portkey docs: Claude Code integration
- Portkey docs: LangChain (Python) integration
- Portkey docs: AWS Bedrock integration
- Portkey-AI/gateway on GitHub (MIT license, last push May 25, 2026, last release v1.15.2)
- Palo Alto Networks: General availability of Prisma AIRS AI Gateway (Jul 16, 2026)
- Palo Alto Networks Form 10-K for the fiscal year ended Jul 31, 2026: Portkey acquisition completed May 29, 2026
- Portkey-AI/gateway issue #1718: SSRF allowlist bypass via the /v1/proxy/* route, gateway 1.15.2 and earlier (Jul 3, 2026)
- Portkey-AI/gateway issue #1237: caching change caused a platform outage for a Portkey cloud customer (Jul 23, 2025)
- Portkey-AI/gateway issue #1759: is this going to be maintained? (Aug 5, 2026)
- Portkey-AI/gateway issue #1739: Glama's actively maintained fork, Lightport (Jul 18, 2026)
- Portkey-AI/gateway issue #1814: 95 of 126 matched catalog models retired at their provider (Sep 20, 2026)
- Portkey-AI/gateway issue #1808: the support address linked from the gateway bounces (Sep 15, 2026)
- crmne/ruby_llm issue #1269: an embedding batch through Portkey returned a single embedding (Oct 22, 2026)
- Hacker News: Show HN: Aqueduct AI Gateway, from a TU Vienna team (Jul 1, 2025)