Can we limit which AI models our staff can use?

Yes. A team admin can limit each key to a list of named models, and the router chooses only from the routing pool the team owner sets. A key limited to named models cannot use the router.

Can we see which model answered each request?

Yes. Every response names the model that was requested and the model that served it, the reason it was served that way, and its cost. The console shows requests and cost for each key.

Does Conifer use our data to train models?

No. Conifer does not use customer content to train models, its own or a third party’s. The provider that serves a request handles it under its own terms.

Can we keep our existing Azure OpenAI agreement?

Yes. Add your Azure OpenAI resource to the Conifer gateway and call your deployments with the same Conifer key. Usage is billed to your Azure agreement and Conifer adds no fee.

Government and enterprise

AI governance for government and enterprise

Conifer records which model ran, what it cost and which key sent each request, and applies your limits before a request reaches a model provider.

Request a briefing

What it covers

Organizations that use AI models across many teams need to answer three questions about each request: who sent it, which model answered, and what it cost. They also need to stop requests that fall outside policy before they run. The Conifer gateway and router are built around those questions.

Limits apply before a request reaches a model provider, and every request leaves a record of the model, the key and the cost.

Controls applied before a request runs

Model scope per key: A team admin can limit a key to a list of named models. The key cannot call any other model. The scope follows the live catalog, so a new model needs no new key.
Approved routing pool: When Conifer chooses the model, it chooses only from the routing pool the team owner sets.
Spend cap per key: Once a key reaches its own spend cap, its requests are refused, whatever the account balance.
Monthly limit: A monthly charge limit bounds the total spend on the account.
Ceiling per request: A request can carry a hard cost ceiling. If it could cost more, it is refused before any provider is called and nothing is spent.
Prepaid balance: A request the balance cannot cover is refused and costs nothing.
Revocation: Keys are revoked one at a time and stop working within seconds. Other keys are not affected. A person who leaves or is removed from a team loses their company keys.

A record of every request

Requested and served model: Every response names the model the caller asked for and the model that answered.
Reason: It also says why: served as requested, served by another provider after a failure, or chosen by the router.
Cost: The settled cost of the request, broken down into input, output and cached tokens.
Request id: A unique id for each request, for support and reconciliation.
Usage by key: The console shows requests and cost for each key. On a team, owners and admins see team usage.
Retained details: For each request Conifer keeps the account and key that made it, the model, the provider, token counts, the charge, timings and any error, without the text of the prompt or response.

# Receipt headers on an example response
x-conifer-requested-model: claude-sonnet-5-5
x-conifer-effective-model: claude-sonnet-5-5
x-conifer-receipt-reason:  as_requested
x-conifer-cost-nanousd:    1842000  # $0.001842

How request data is handled

Prompts: The gateway does not store the prompt of a standard request.
Response cache: A response is held for ten minutes so that a retried request returns the original response instead of being charged twice.
Training: Conifer does not use customer content to train models, its own or a third party’s.
Model providers: The provider that serves a request handles it under its own terms, including how long it keeps requests. Naming a model lets you send a workload only to a model whose provider terms you have reviewed.
Automatic model choice: When Conifer chooses the model, the request content also goes to the router, which may be Conifer’s router service or a decision model hosted by one of its model providers. A named request does not.
Your own provider contract: An Azure OpenAI resource you own can sit behind the Conifer key. Usage on it is billed to your Azure agreement, the key is verified before it is stored and is kept encrypted, and Conifer adds no fee.
Subprocessors: The companies that process data for Conifer are listed on the subprocessors page. The privacy policy sets out retention for each kind of data.

Not available today

These are stated so that you can plan around them.

AWS Bedrock and Google Vertex: Not served as bring-your-own endpoints.
Azure identity: Entra ID and managed identity are not available on the self-serve Azure form.
Team creation: There is no console button to create a team. Conifer sets up team accounts on request.
Sign-in: The console accepts email and password, Google or GitHub.

Questions

Can we limit which AI models our staff can use?: Yes. A team admin can limit each key to a list of named models, and the router chooses only from the routing pool the team owner sets. A key limited to named models cannot use the router.
Can we see which model answered each request?: Yes. Every response names the model that was requested and the model that served it, the reason it was served that way, and its cost. The console shows requests and cost for each key.
Does Conifer use our data to train models?: No. Conifer does not use customer content to train models, its own or a third party’s. The provider that serves a request handles it under its own terms.
Can we keep our existing Azure OpenAI agreement?: Yes. Add your Azure OpenAI resource to the Conifer gateway and call your deployments with the same Conifer key. Usage is billed to your Azure agreement and Conifer adds no fee.

Request a briefing

To discuss a deployment for your agency or company, choose Government briefing or Enterprise briefing on the contact form.

Contact Conifer