Comparison / 13 capabilities
YTT Secunet vs Cloudflare AI Gateway
Cloudflare AI Gateway is a polished proxy for AI traffic that runs on Cloudflare's global network.
Matrix tally
- YTT Secunet edge7
- Parity1
- Cloudflare AI Gateway edge5
Rows where Cloudflare AI Gateway is stronger are marked as such. Filter the matrix below to read them first.
It gives you caching, rate limiting, spend limits, dynamic routing with conditional branches, traffic splits and fallbacks, guardrails for harmful content, data loss prevention that flags or blocks sensitive data, encrypted storage of provider keys, analytics and logging with Logpush, across more than twenty providers. If your goal is cost control and observability for LLM calls, it is hard to beat. The two products answer different questions. Cloudflare optimises how AI calls are made; YTT Secunet constrains where they may go and proves where they went. Cloudflare's own Data Localization Suite compatibility table lists AI Gateway as not supported by Regional Services, and YTT Secunet is designed around that residency question from the data plane up.
| Capability | YTT Secunet | Cloudflare AI Gateway | Edge |
|---|---|---|---|
| Global edge network and DDoS protection | Regional data planes in the EU, UK, Switzerland, GCC, APAC and the US. Not a global anycast network. | One of the largest anycast networks in the world, with DDoS mitigation and WAF on the same platform. | Alternative edge |
| Response caching | None by design. Zero data retention means prompts and completions are streamed in memory and never written to disk. | Serves identical requests from Cloudflare's cache, configurable per gateway or per request. | Alternative edge |
| Rate limits and spend limits | Policies can refuse requests by tenant or category; spend budgeting is not YTT Secunet's focus. | Sliding or fixed window rate limits and dollar budgets scoped by model, provider or metadata. | Alternative edge |
| Routing logic | Jurisdiction resolved from tenant domicile, geo-IP or data sensitivity, then an endpoint chosen from a registry of certified in-jurisdiction deployments. | Dynamic routes with conditional branches on body, headers or metadata, percentage splits, rate and budget nodes, versions and rollback. A team can encode jurisdiction rules here by hand. | YTT Secunet edge |
| Failover scope | Failover candidates are restricted to the same legal jurisdiction, and the request is refused if none is healthy. | Fallbacks go to whichever model or provider you configured. Keeping them inside a jurisdiction is your configuration discipline. | YTT Secunet edge |
| Localisation of the gateway itself | EU control plane in Frankfurt with Paris standby on EU-headquartered infrastructure; regional data planes; or Sovereign Dedicated inside your VPC. | Cloudflare's Data Localization Suite compatibility table lists AI Gateway as not supported by Regional Services and notes that jurisdictional storage restrictions for its logs are not supported. Check the current table before relying on either point. | YTT Secunet edge |
| Content guardrails | Not a content moderation product. Focuses on residency, identifiers and evidence. | Guardrails moderate prompts and responses in real time and block harmful content. | Alternative edge |
| Sensitive data handling | Detects and pseudonymizes names, IBANs, passport numbers and national IDs, keeps the token vault in the origin jurisdiction and restores values in the response. | DLP scans prompts and responses for PII, financial and health data and custom patterns, then flags or blocks the request. | YTT Secunet edge |
| Prompt and response logging for debugging | No prompt logs at the gateway. Receipts hold hashes and routing facts, not content. | Full request and response logs with configurable retention, analytics and export through Logpush. | Alternative edge |
| Proof of residency | Ed25519-signed JWS receipt per response, hourly SHA-256 Merkle root, open-source offline verifier. | Logs and analytics record provider, model, tokens and cost, held by Cloudflare and exported by you. | YTT Secunet edge |
| Policy authoring | OPA and Rego packs per jurisdiction, with a visual editor for legal review and version history. | Dashboard and API configuration, plus Workers for custom logic in code. | YTT Secunet edge |
| Provider coverage | Hosted providers, sovereign clouds and self-hosted vLLM or Ollama runtimes. | More than twenty providers, plus Workers AI models running on Cloudflare's own GPUs. | Parity |
| Deployment model | SaaS, customer VPC, on-prem or air-gapped with offline licensing and customer-held signing keys. | Managed service on Cloudflare's network. | YTT Secunet edge |
- Your main goals are caching, cost control, rate limiting and observability across several model providers.
- You already run your edge, WAF and Zero Trust on Cloudflare and want AI traffic in the same dashboard.
- Content guardrails and a DLP rule that blocks sensitive prompts meet your requirements, and no customer asks for per-request residency proof.
- Your users are spread worldwide and edge proximity matters more than jurisdictional pinning.
- Contracts or regulators require that inference for a tenant stays inside a named jurisdiction, including during failover.
- You need sensitive identifiers pseudonymized and restored rather than blocked, so the request can still be answered.
- Your gateway must itself run in-region, in your VPC or air-gapped.
- Auditors want signed, independently verifiable evidence of where each request was processed.
Most teams run both for a while. These steps keep your current setup serving traffic until the receipts show the new route is doing what policy says.
- 01
Keep Cloudflare in front of your application for DDoS protection and WAF. Point the AI SDK base URL at the YTT Secunet regional endpoint instead of the AI Gateway URL.
- 02
Translate dynamic routes into Rego: conditional branches on metadata become policy inputs such as tenant domicile, and fallback nodes become in-jurisdiction failover sets.
- 03
Replace DLP block rules with pseudonymization for identifiers that may travel as tokens, and keep hard blocks for categories that must never leave.
- 04
Decide where debugging data lives. Send receipts to your SIEM, and if you need prompt logs, keep them in a store inside the same jurisdiction.
- 05
Verify a week of receipts with ytt-verify before moving the remaining traffic.
Whatever sits in front of your providers today, the integration point for YTT Secunet is the inference client. The base URL moves to the regional entry point for the tenant's zone, and two headers name the tenant and the policy pack.
Request and response bodies keep the OpenAI or Anthropic schema, so streaming, tool calls and JSON mode work as before. The model name becomes a logical alias that the endpoint registry maps to an in-zone deployment.
- A denied request returns HTTP 451 with a decision id, never a silent reroute
- Every response carries a signed residency receipt header
- Receipts export to your SIEM alongside your current gateway logs
import OpenAI from "openai";
// Before: provider default endpoint, region decided by the provider.
// After: YTT Secunet regional entry point, zone decided by policy.
const client = new OpenAI({
baseURL: "https://eu.yttsecunet.com/v1",
apiKey: process.env.YTT_SECUNET_API_KEY,
defaultHeaders: {
"X-YTT-Policy": "eu-gdpr-strict@4.2.0",
"X-YTT-Tenant": tenant.id,
},
});
const res = await client.chat.completions
.create({ model: "gpt-4o", messages })
.withResponse();
const receipt = res.response.headers.get("x-ytt-proof-signature");Can we use Cloudflare and YTT Secunet together?
Yes, and many teams should. Cloudflare protects and accelerates your application edge. YTT Secunet handles the outbound inference path where jurisdiction, pseudonymization and evidence matter. They solve different layers of the problem.
Cloudflare's dynamic routing can branch on headers. Why not encode jurisdiction there?
You can encode a first pass that way. What you would still own is the inventory of which endpoints are in which jurisdiction, failover that never leaves it, reversible pseudonymization, a policy legal can review, and a signed record of each decision. Those are the parts YTT Secunet maintains.
Does Cloudflare's Data Localization Suite cover AI Gateway?
Cloudflare publishes a product compatibility table for the suite. In late 2026 it listed AI Gateway as not supported by Regional Services and noted that jurisdictional storage restrictions for AI Gateway logs were not supported. Cloudflare updates that table, so check the current version.
Sovereign route ready
Put both on the same traffic and compare the evidence.
Start a 14-day trial, route one tenant through YTT Secunet, and check every receipt with the open-source verifier.