The usual way to stop sensitive data reaching a cloud model is to inspect each request on the way out: an AI gateway such as Kong's or Prisma AIRS (formerly Portkey) with a personal-data check, or a specialist such as Limina that redacts the prompt first. The other way is to keep the model local, as LM-Kit One does, and never call the cloud at all. Each of them does its one job well.
Marmot puts the two together and changes where the decision comes from. The documents are labelled once, when they are loaded, and the machine that holds them has no route out; a second machine decides, request by request, whether anything may go to a cloud model, and writes the decision down before it does. Detection still has a place, on what users type, but it is the second line rather than the only one.
Reviewed on 26 September 2026. Every statement about another product cites the vendor's own page, read that day; the sources are at the end. "Not described on the pages we read" means exactly that, and not that the product cannot do it.
| Question | Marmot | Kong AI Gateway | Prisma AIRS AI Gateway (Portkey) | Limina | LM-Kit One |
|---|---|---|---|---|---|
| What it is | On-premises AI for your people, on two machines: a chat interface, a local model and your documents on one, and a gate to cloud models on the other. | A gateway that governs LLM, MCP and agent-to-agent traffic.[1] | An AI gateway, formerly Portkey, now part of Palo Alto Networks' Prisma AIRS.[7][8] | A service that detects and removes personal data, including from prompts before they reach a cloud model.[14][17] | A local AI server, with a .NET SDK beside it, for running models on your own machines.[19][20] |
| A local model and chat for users | Yes. The model and the chat interface run on the machine that holds the documents. | A gateway; it can route requests to self-hosted models.[4] | A gateway; not described on the pages we read. | A de-identification service; not described on the pages we read. | Yes: local models, with Open WebUI as the chat workspace.[20][22] |
| How it decides what may reach a cloud model | Documents are labelled once, at ingestion, with a person reviewing the hard cases, and anything unlabelled counts as sensitive. What a user types has no label, and goes through a classifier, which is probabilistic. | Personal data detected on each request by an NLP service (an Enterprise plugin), and regular-expression allow and deny lists.[2][3] | Guardrails and personal-data detection on each request; a failed check can deny the request or fall back to another model.[9][10] | It does not route: it redacts each prompt, by detection, before your application sends it to the cloud.[17] | No gate to cloud models is described. |
| The machine with the data has no internet route | Yes, by design. Only the gate machine can reach the internet, and it holds no documents. | Not described on the pages we read. | The standard hybrid deployment needs outbound HTTPS to the control plane; an air-gapped mode is listed as legacy.[11] | Runs in your VPC or on premises. Its home page says "no outbound calls"; its FAQ says the container "phones home for authentication and usage reporting".[14][16] | Yes: air-gapped operation is a supported mode.[20] |
| Who may read what | Answers draw only on the documents the person asking is cleared to read. | Not described on the pages we read. | Not described on the pages we read. | Not described on the pages we read. | Sessions, files and collections are bound to their owner.[21] |
| Detecting personal data | A classifier on typed text, as the second line; the labels are the first. | Nine language images, Portuguese among them, with an NLP model in each.[2] | Personal-data redaction across five guardrail providers.[9] | More than 50 entity types, 14 languages with core support and 39 with extended support, Portuguese among the core; misses between 0.2% and 7% on its own benchmark.[14][15] | NER and PII extractors, with a human review step; it says plainly that model quality never reaches perfection.[19][23] |
| Beyond the chat | One route to the cloud, through the gate, and nothing else. | Many providers, semantic routing and load balancing, and MCP and agent traffic through the same gateway.[1][4] | Broad model routing with retries, fallbacks and load balancing; an open-source gateway.[10][13] | Text, PDFs, images, audio and structured data.[14] | OCR, extraction, RAG with citations, agents and speech, with local APIs in the OpenAI, Anthropic and Ollama shapes.[19][20] |
| Track record | From DeltaCoders, which has built security software for regulated organisations since 2011. | An Apache 2.0 open-source core; its certifications we could not read, because its trust page did not load for us.[6] | SOC 2, ISO 27001, GDPR and HIPAA, with Palo Alto Networks behind it.[8][12] | ISO 27001:2022 and SOC 2 Type 2 for its own operations.[18] | Signed installers and SBOMs; no certification on its pages.[21] |
When to pick them instead
Pick an AI gateway, Kong's or Prisma AIRS, if the job is routing many applications to many models, with fallbacks, load balancing and MCP traffic in the same place; Marmot has one route out and is not a gateway. Pick Limina if what you need is the best detection of personal data you can get, across many languages and formats, in front of a cloud model you have already chosen. Pick LM-Kit One if nothing should ever reach the cloud and you want a broad local stack, from OCR to agents.
When Marmot is the better fit
When your people need a capable assistant and some of your documents may never leave the building, and you would rather prove that than hope for it. The decision rests on labels a person approved, not on a detector catching every case; unlabelled content is treated as sensitive; users can force a request to stay local and can never force one out; answers respect what each person is cleared to read; and the decision log can be reconciled against your own firewall rather than taken on trust.
See how Marmot works.
Sources
- Kong, Kong AI Gateway, https://konghq.com/products/kong-ai-gateway, read on 26 September 2026.
- Kong documentation, AI Sanitizer plugin, https://developer.konghq.com/plugins/ai-sanitizer/, read on 26 September 2026.
- Kong documentation, AI Prompt Guard plugin, https://developer.konghq.com/plugins/ai-prompt-guard/, read on 26 September 2026.
- Kong documentation, AI Proxy Advanced plugin, https://developer.konghq.com/plugins/ai-proxy-advanced/, read on 26 September 2026.
- Kong documentation, Audit logs, https://developer.konghq.com/gateway/audit-logs/, read on 26 September 2026.
- Kong, source repository, https://github.com/Kong/kong, read on 26 September 2026.
- Portkey, home page, https://portkey.ai/, read on 26 September 2026.
- Palo Alto Networks, Announcing general availability of Prisma AIRS AI Gateway, https://www.paloaltonetworks.com/blog/2026/07/announcing-general-availability-of-prisma-airs-ai-gateway/, read on 26 September 2026.
- Portkey documentation, PII redaction, https://portkey.ai/docs/product/guardrails/pii-redaction, read on 26 September 2026.
- Portkey documentation, Guardrails, https://docs.portkey.ai/docs/aigw/product/guardrails.md, read on 26 September 2026.
- Portkey documentation, Private cloud deployments, https://portkey.ai/docs/product/enterprise-offering/private-cloud-deployments, read on 26 September 2026.
- Portkey documentation, Security, https://docs.portkey.ai/docs/aigw/product/enterprise-offering/security.md, read on 26 September 2026.
- Portkey, gateway source repository, https://github.com/Portkey-AI/gateway, read on 26 September 2026.
- Limina, home page, https://getlimina.ai/, read on 26 September 2026.
- Limina documentation, Languages, https://docs.getlimina.ai/languages.md, read on 26 September 2026.
- Limina documentation, FAQ, https://docs.getlimina.ai/faq.md, read on 26 September 2026.
- Limina documentation, LLMs, https://docs.getlimina.ai/configuration-and-operations/advanced-features/llms.md, read on 26 September 2026.
- Limina documentation, Security, https://docs.getlimina.ai/configuration-and-operations/container-management/security.md, read on 26 September 2026.
- LM-Kit, LM-Kit.NET, https://lm-kit.com/products/lm-kit-net/, read on 26 September 2026.
- LM-Kit, LM-Kit One, https://lm-kit.com/products/lm-kit-one/, read on 26 September 2026.
- LM-Kit, LM-Kit One security, https://lm-kit.com/products/lm-kit-one/security/, read on 26 September 2026.
- LM-Kit, LM-Kit One with Open WebUI, https://lm-kit.com/products/lm-kit-one/open-webui/, read on 26 September 2026.
- LM-Kit, PII review and redaction, https://lm-kit.com/use-cases/pii-review-and-redaction/, read on 26 September 2026.
Kong, Portkey, Prisma AIRS, Palo Alto Networks, Limina, LM-Kit and Open WebUI are trademarks of their owners, named here only to compare. Something here out of date or wrong about your product? Tell us and we will correct it.