"Redact the logs and you cannot debug" is a false trade. Here is how write-time redaction, typed structure-preserving placeholders and metadata scrubbing keep LLM request logs reproducible while the sensitive values never reach durable storage.
The fields that make an LLM request log worth keeping, the content that turns it into a liability, and how a gateway's built-in logs compare with running your own self-hosted trace store.
A guardrail that runs on a sample is not a guardrail. Here is how nRouter applies PII redaction, prompt-injection detection and keyword blocklists inline on every call, with key-over-team-over-org precedence, on every plan.
The most important number in an LLM gateway is what a call cost, and it is the easiest one to fudge. We read the provider's settled cost and pass it through exactly; when it is unknowable we say unpriced, never zero.
nRouter has no sandbox, no sample dataset, and no demo mode. The dashboard figure, the playground response, the cost header and the ledger row are all produced by the same live path a paying request takes. The cost of that honesty is that there is nothing to look at until you have paid for a call.
"Who rotated that key, and from where?" should be a filter, not an archaeology project. Here is the audit-trail contract we hold ourselves to on an LLM gateway: complete actor attribution, one shared client-IP path, append-only entries, and reads that are role-scoped and tenant-isolated.
A criterion-by-criterion checklist for putting an LLM gateway through SOC 2 — access control, audit attribution, retention, encryption, tenant isolation and availability — with the honest current state of each control on nRouter.
