> For the complete documentation index, see [llms.txt](https://docs.maiagent.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.maiagent.ai/tech/en/ai-gateway/ai-gateway-security.md). # AI Gateway Security What the “AI relay service” incidents reveal about the real risks of using multiple models in enterprises, and the safeguards and current limitations of MaiAgent AI Gateway across five areas—sources,

A comparison of unofficial AI relay services and enterprise AI Gateways — Both sit between you and the model. The difference is whether they can be verified.

Over the past two years, enterprises have adopted more AI models, and their integrations have become increasingly fragmented. OpenAI, Anthropic, and Google each have their own APIs. Development teams switch between providers to find the best and cheapest model for each task, while token usage grows by multiples. A new role has naturally emerged in the market: an intermediary between users and models, offering access to multiple providers through a single entry point, with unified keys and billing. There are legitimate versions of this role. For example, the US-based OpenRouter offers access to more than 400 models through a single entry point. There are also gray-market versions. In China, regional restrictions on overseas models have led to a proliferation of unofficial “AI relay services.” No overseas account or credit card is required: for a small payment in renminbi, users can access Claude, ChatGPT, and Gemini at just 10–30% of the official price. The cost of that low price is that all the risk falls on the user. Customers have asked us: **Doesn't MaiAgent also sit between users and models? Does that convenience come with the same security concerns?** This is a good question that deserves a careful answer. This article has two parts: Sections 1 and 2 explain what AI relay services are and the methods unofficial operators use; Sections 3 and 4 explain what MaiAgent AI Gateway does differently in the same position. ## 1. What Is an AI Relay Service? Let's start with a technical term: API. Think of it as a restaurant's ordering window. A program sends a question through the window, the AI service processes it, and the answer comes back through the same window. An “AI relay service” adds another window between the user and the AI service. Users think they are connecting to a single site, but their questions are actually forwarded to several model providers behind it. It is like a purchasing agent in the AI world. This business is particularly widespread in China for four structural reasons: * **Regional restrictions**: OpenAI does not support China, and Anthropic does not provide Claude directly in China. In 2025, Anthropic further restricted access for overseas companies that are majority-owned by entities in unsupported regions such as China. * **High barriers to access**: Overseas accounts, payments, and identity verification are cumbersome. Relay services handle them all for users. * **Explosive demand for tokens**: A token is a unit used to measure the amount of text a model processes, roughly equivalent to one Chinese character. In March 2026, Chinese authorities announced that annual domestic token usage had grown more than a thousandfold. The AI Agent era is driving even faster consumption. * **Changing user priorities**: Developers have begun asking which model is best and cheapest for each task. Access to multiple models through a single entry point is naturally more convenient. An intermediary is not inherently a bad thing, and whether it operates in a gray area has nothing to do with its country—it depends on whether it can be verified. Legitimate intermediaries are already a major business. Recent industry reports describe a payment company's announcement of plans to acquire OpenRouter for more than US$7.5 billion. As AI becomes infrastructure, enterprises increasingly centralize all AI calls through a gateway that decides which model receives each request. The question is not whether there is an intermediary, but whether that intermediary can be trusted and verified. ## 2. Inside Unofficial Relay Services Interviews by Chinese media with unofficial operators and users have examined this industry chain in detail.

How unofficial AI relay services work and their three risks — Figure 1: How unofficial AI relay services work and the three risks users bear

### A Lower Barrier to Entry Than You Might Expect An operator using a pseudonym described the typical setup to Nanjing News: rent an overseas cloud server, download open-source AI gateway software, prepare a batch of overseas model accounts, add ready-made scripts, and connect a payment system. That is enough to start operating. Operators attract users with platform trial offers and low-cost monthly plans, then direct them to WeChat groups or their own websites to top up their balances. Some operators run three sites at once, selling Claude, ChatGPT, and enterprise services separately. ### “Account Pools” Make the Low Prices Possible Claude's official pricing is fixed, yet some relay services charge just 10–30% of the official price. How can they be so cheap? The answer is account pools: operators register or acquire large numbers of overseas accounts and maintain them automatically with scripts. Each time a user asks a question, the system selects an account that still works from the pool. When that account is suspended, it switches to the next one. Where do these accounts come from? Researchers have identified sources such as new-user promotions, other people's unused credits, and enterprise or education discounts. None of these sources offers a basis for a service contract. ### Three Risks Users Bear **The service can disappear overnight.** One user purchased a plan for RMB 25 per month that claimed to provide US$120 in daily allowance. About 20 days later, a wave of mass account suspensions hit, and the store disappeared. After switching services, the monthly fee rose to three or four times the original price. The operator's explanation was that “upstream services had suffered a severe disruption.” China began a crackdown in late May 2026, and large numbers of operators shut down. **You may not know which model you are using.** A German research team investigated 17 unofficial relay services, comparing response characteristics on test questions to determine whether the model behind each service matched its claims—a technique called model fingerprinting. Nearly half of the models tested failed. In other words, users paying for a high-end model may receive a downgraded version that performs nearly 50% worse than the official model. **Your prompts pass through strangers' hands.** US researchers tested relay services purchased on e-commerce platforms such as Taobao and Xianyu. Nine services actively injected malicious code, and several triggered fake keys that the researchers had deliberately planted to detect unauthorized use. Some sites even used stolen private keys to steal cryptocurrency. China's Ministry of State Security has also publicly warned that some relay platforms intercept and steal user data, raising concerns about leaks of sensitive enterprise information. One point is worth remembering: **As AI increasingly becomes infrastructure like water and electricity, we need to trust not only the companies providing AI services, but also the intermediaries deciding where your questions ultimately go.** ## 3. Five Questions Enterprises Should Ask Combining the three risks above with the accountability and records that enterprise procurement requires gives us five questions to ask when evaluating any AI intermediary: 1. **Where do my requests go?** To an official endpoint, or through another invisible intermediary? 2. **Which model am I using?** Is the model I specify the one that actually runs? 3. **Who can see my prompts?** How are they handled in transit, at rest, and within the intermediary itself? 4. **Who is accountable when something goes wrong?** Is there a legal entity, contract, or certification that establishes accountability? 5. **Are there records I can reconcile?** Can each call be traced back to who made it, when, which model it used, and how much it cost? Unofficial relay services can answer almost none of these questions. Next, let's look at how MaiAgent answers them. ## 4. How MaiAgent AI Gateway Answers These Five Questions First, what is MaiAgent AI Gateway? It is a gateway for enterprises to centrally manage all AI model calls. When systems within an enterprise connect to language models, they no longer need to apply for keys and integrate with providers individually. All calls pass through a single entry point, allowing the enterprise to centrally control which providers' models to use, who can use them, how much they can use, and how much they can spend. It is compatible with the OpenAI interface specification, so existing programs written with the official OpenAI libraries can connect simply by changing the connection URL to MaiAgent. Three terms used in this article need an explanation: an **endpoint** is the connection URL for a model service; **bring your own key (BYOK)** means your company supplies an API key obtained through its own contract with a provider, and the platform uses it to make calls on your behalf; a **fallback group** is a configuration that automatically switches to backup models when the primary model has a problem. Architecturally, AI Gateway occupies the same position as a relay service: between you and the model. The differences are shown in the diagram below.

MaiAgent AI Gateway architecture and its five areas of control — Figure 2: The position of MaiAgent AI Gateway and its five areas of control

### Question 1: Where Do Requests Go? * **Amazon Bedrock connects directly through the official AWS libraries.** The code for this path has no configuration that can override the endpoint. * **OpenAI and Anthropic use their official APIs.** Google models use Google Cloud Vertex AI. * **MaiAgent centrally configures the endpoints for platform-managed models.** None of your company's accounts can change them through the administration interface or API, preventing accidental or malicious redirection to unofficial endpoints. Major providers use official endpoints; some models are accessed through established commercial model marketplaces such as OpenRouter. These are all identified in the endpoint list. * **Your company specifies the endpoints for its custom models.** For example, you can use BYOK to connect to your company's self-hosted vLLM or OpenAI-compatible service. Only your company can change these settings. * On request, we can provide the list of models actually enabled for your company and their connection endpoints for item-by-item reconciliation. The precise statement is: **You can look up the endpoint of every model your company uses. Only we can change platform-managed endpoints, and only your company can change its custom endpoints.** ### Question 2: Which Model Are You Using? * Organization administrators configure **model allowlists and blocklists** in the administration interface. The backend enforces these controls. If an Agent specifies a model outside the allowlist, the backend rejects the request outright. * The model name exposed by the Gateway (an alias) can be configured separately from the actual model. MaiAgent platform administrators can configure which organizations may use each alias. * **Every request records the actual resolved model**, the provider, and whether BYOK was used. * Your company creates and orders fallback groups, and only organization owners can configure them. The full fallback chain is enabled only when a call sends the group identifier as the model name; ordinary calls that do not specify a group are not automatically rerouted. Switching occurs only when the primary model times out, the connection fails, the provider imposes rate limits, or a server-side error occurs. Client-side errors such as invalid parameters or invalid keys do not trigger fallback, so configuration errors are not concealed. ### Question 3: Who Can See Your Prompts? We address this directly: **In platform-managed mode, MaiAgent can see them.** Conversation records are part of the auditing and traceability features. The difference lies in the protections in place and the choices available to your company. The same protections for transmission and storage apply across all three tiers: encrypted connections throughout the site (HTTPS, with HSTS enforcing encrypted browser connections), encryption at rest for databases and file storage, organization-level data isolation, and no code path that sends customer data for training. The difference between the three tiers is whether the intermediary itself can see the data.

Trust tiers for three types of model sources — Figure 3: Who can see prompts for each of the three types of model sources

Trust tier	Who can see prompts	Additional protections
Platform-managed	MaiAgent and the model provider	Under its service terms, Amazon Bedrock does not use customer inputs to train models; other providers follow their respective API service terms.
Bring your own key (BYOK)	MaiAgent and the provider your company has contracted with	Your company's keys are encrypted at rest using the industry-standard AES-256-GCM algorithm. The ciphertext is deliberately kept out of queryable fields and cannot be retrieved through database queries. The administration interface shows only a masked preview, and the key cannot be read back.
On-premises deployment (both the platform and models are in your company's data center)	Only your company	Language models and embeddings (converting documents into searchable numerical representations) can point to self-hosted model services such as vLLM or Ollama on your company's internal network. Reranking (selecting the most relevant passages) currently supports vLLM. When all three layers stay on the internal network, data sent to models for processing never leaves it—even MaiAgent cannot see it.

{% hint style="warning" %} If only the models are hosted on your company's internal network while the MaiAgent platform still uses the SaaS version, prompts still pass through the SaaS platform before reaching the internal models. The data flow is the same as in the first row. {% endhint %} ### Question 4: Who Is Accountable When Something Goes Wrong? * MaiAgent is operated by Playma Co., Ltd., registered in Taiwan. It has a formal contractual relationship with your company and issues invoices in New Taiwan dollars. * The company holds ISO 27001:2022 certification for information security management and ISO 27701:2019 certification for privacy information management, with annual surveillance audits. * A disclosure list of the platform's third-party services (AWS, Cloudflare, Elastic Cloud, and Sentry) and their compliance certifications is available on request through the process in Section 5. We provide advance notice when adding critical services. * With fallback groups enabled, an outage at the primary provider can trigger a switch to a backup model, rather than the service disappearing overnight as an account pool might. ### Question 5: Are There Records You Can Reconcile? Every request through the Gateway creates an audit record with fields including: * Request identifier, organization, API key used, and member * Model alias requested by the client, actual resolved model and provider, and whether BYOK was used * Input and output token counts, and token counts for cache creation and reads (temporary storage of repeated content) * Total latency, upstream latency, and time to the model's first token * Processing status and billing status The accompanying controls apply **before** a call: **Organizations with insufficient credit are blocked before the call** (based on wallet balance and the minimum balance threshold, with plan status checked at the same time). Calls do not run first and get reconciled afterward. Your company can view usage dashboards and credit transaction details in the administration interface, and every credit deduction includes the provider and model name. Returning to the opening question: the difference between MaiAgent and a relay service lies in your company's ability to verify every aspect of the service, rather than in their architectural position. ## 5. Getting Started 1. Contact to enable AI Gateway for your company's organization. 2. Choose a trust tier based on your company's data classification: platform-managed, BYOK, or on-premises deployment. 3. Change the connection URL in your existing programs to the MaiAgent Gateway endpoint and use your organization's API key for Bearer authentication. No changes to the calling logic are required. 4. Configure available models, fallback groups, and usage limits in the administration interface, then start reconciling usage through the dashboard. {% hint style="info" %} References: The industry data and research findings about unofficial relay services in this article are cited indirectly from the September 5, 2026 report by LINE TODAY's “TODAY World View,” [“Top-tier AI without a VPN? Inside China's lucrative ‘AI relay service’ industry!”](https://youtu.be/UtjsrVr2jZg). That report compiled information from Nanjing News, Yicai, National Business Daily, and research teams in Germany and the United States. This article has not independently verified the original research. {% endhint %} {% hint style="success" %} If your company's security or audit team needs a complete explanation of platform security, a third-party service disclosure list, or a technical meeting to review your requirements item by item, please submit a request through your sales contact. We will provide the relevant documentation. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.maiagent.ai/tech/en/ai-gateway/ai-gateway-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.