Last updated: October 25, 2026. CodeGateway is a jurisdiction-aware multi-model AI gateway for engineering teams worldwide, operated by WHITEDIT LTD (registered in the UK). This page discloses the platform compliance capabilities in matrix form. Every "Shipped" row carries its code evidence (file and function name; line numbers drift with refactors). Certification and organization items are likewise disclosed as they are. Availability is subject to applicable sanctions law and the geographic restrictions in the Terms of Service; this page is not a promise of availability in any region.
| Provider / model group | Catalog group | Access path | Billing |
|---|---|---|---|
| Anthropic (Claude family) | international | Cloudflare AI Gateway (keyless, cf-aig-authorization) | Usage-based (current flat 1.07× markup; see the pricing page) |
| OpenAI / Codex | international | Cloudflare AI Gateway (keyless) | Same |
| Google (Gemini family) | international | Cloudflare AI Gateway / Workers AI (keyless) | Same |
| Cloudflare Workers AI (@cf/ native models) | international | Workers AI OpenAI-compatible endpoint (keyless) | Same |
| GLM / Kimi / DeepSeek / Qwen | domestic | Mostly keyless paths; DeepSeek and Moonshot are legacy direct adapters (recorded in the ADR) | Same |
This table states model sources and access paths as facts of the model catalog grouping. It is a disclosure of the provider topology and makes no statement about regional availability. Per-model group tags are a later enhancement; they require an API change first.
| # | Capability | Status | Code evidence |
|---|---|---|---|
| 1 | IP-based access blocking for OFAC comprehensively sanctioned regions (Cuba, Iran, North Korea, and the Crimea, Donetsk and Luhansk regions of Ukraine), returning HTTP 451 on a hit. Syria is currently blocked as a product-policy measure and is not a current OFAC comprehensive embargo. This is not SDN/entity-list screening; SDN, EU, UN and UK list compliance relies on the user representations in the Terms of Service | Shipped | backend/src/geo-block.ts (SANCTIONED_COUNTRIES / buildSanctionedResponse); backend/src/index.ts (isSanctioned gate, runs first in request handling); issue #609 |
| 2 | Sanction-hit logs record only country/region, path, method and timestamp, with no IP. The API request-log table (request_logs) has no IP column. Security and abuse-prevention audit events may store an IP address or a salted hash; see Privacy Policy §3 and §7 for purpose and retention | Shipped | backend/src/geo-block.ts (logSanctionedHit; no IP written); backend/migrations/0057_workspaces_init.sql (workspace_audit_logs.ip); backend/src/routes/wire-requests/audit.ts (audit IP); backend/src/feedback/handler.ts (ip_hash) |
| 3 | API keys are stored as SHA-256 hashes only; the plaintext is returned once, at creation | Shipped | backend/src/routes/workspace-api-keys/crud.ts (key_hash only, via sha256hex); backend/src/auth.ts (sha256hex) |
| 4 | Account passwords use salted PBKDF2 (100,000 iterations) | Shipped | dashboard/lib/auth.ts (PBKDF2_ITERATIONS = 100_000) |
| 5 | Two-factor TOTP; secrets are stored AES-256-GCM encrypted with AAD binding | Shipped | dashboard/lib/totp.ts (AES_AAD / AES-GCM seed encryption) |
| 6 | Workspace tenant isolation: API keys, request logs, payments and subscriptions all belong to a workspace_id | Shipped | backend/migrations/0057_workspaces_init.sql; 0058_api_keys_workspace.sql |
| 7 | International providers (Anthropic / OpenAI / Google and others) connect keyless through Cloudflare AI Gateway; on this path we hold no provider API keys, and the only gateway credential used is CF_AIG_TOKEN. DeepSeek and Moonshot are legacy direct adapters that use their own API keys (see the ADR) | Shipped | backend/src/upstream-headers.ts (cf-aig-authorization); ADR docs/ARCHITECTURE/provider-keyless-cf-gateway.md |
| 8 | Payments are hosted by Stripe (Stripe Checkout / PaymentIntent); card data stays on the Stripe side. We store Stripe customer, payment-method, PaymentIntent and Checkout Session identifiers; card numbers and CVC are handled only by Stripe | Shipped | dashboard/app/api/billing/checkout/route.ts; backend/src/auto-topup-charge.ts (stripe_customer_id / stripe_payment_method_id / PaymentIntent); backend/migrations/0042_auto_topup_init.sql |
| 9 | Request logs are deleted on schedule: 90 days for successes, 180 days for errors (daily cron) | Shipped | backend/src/cleanup.ts (cleanupOldLogs / LOG_RETENTION_*); backend/src/cron-handler.ts (daily cron) |
| 10 | Workspace usage and request logs are queried per workspace, with self-service compliance-report CSV export | Shipped | backend/src/routes/workspace-compliance-routes.ts (workspaceComplianceRoutes → renderComplianceCsv; WHI-1081) |
| 11 | Transport encryption (TLS) across the site, terminated at the Cloudflare edge | Shipped | Architectural fact: the whole site runs on Cloudflare Workers |
| 12 | Legal document set: Privacy Policy (GDPR / UK GDPR, SCC / UK IDTA transfer terms), Terms of Service (OFAC / EAR / ITAR eligibility and the 451 refusal clause), Refund Policy | Shipped | /privacy, /terms, /refund pages |
| 13 | Google sign-in, available on every tier | Shipped | dashboard/app/[locale]/dashboard/[slug]/billing/plans/plans-data.ts (Google sign-in, every tier) |
| 14 | SSO / SAML+SCIM | Coming soon (planned for Team / Enterprise tiers) | plans-data.ts (SSO_COMING_TIERS); plans/capability-matrix.tsx |
| 15 | Audit-log query and export (tiered retention 7–365 days; CSV (all tiers) / JSON (Tier 3+); Tier 5 R2 archive) | Shipped | backend/src/routes/workspace-audit-routes.ts (audit-logs / export; auditRetentionDaysForTier); plans-data.ts (audit row per-tier ladder) |
| 16 | SOC 2 / ISO 27001 | Not certified | Disclosed as-is; we hold neither |
**Q: Can comprehensively US-sanctioned regions access the service?**
A: Access from Cuba, Iran, North Korea, and Crimea, Donetsk and Luhansk in Ukraine is refused before authentication (HTTP 451). Syria is currently blocked as a product-policy measure and is not a current OFAC comprehensive embargo. This is IP-based geo blocking, not SDN/entity-list screening. The full eligibility terms are in the Terms of Service.
**Q: How long are request logs kept?**
A: Success logs are kept for 90 days and error logs for 180 days; a daily cron job deletes them on schedule. Audit logs are kept for 7–365 days depending on tier. Processing locations, sub-processors and cross-border transfer safeguards are in the Privacy Policy and the subprocessor list.
**Q: How do I manage team usage and quotas?**
A: Each team maps to one workspace: API keys, request logs, balance, payments and subscriptions are isolated per workspace, with per-workspace usage report export. Tiers and team benefits are on the pricing page.
Privacy Policy: /en/privacy
Terms of Service: /en/terms
Refund Policy: /en/refund
Subprocessor list: /en/legal/subprocessors
Pricing and tiers: /en/pricing
This page is not a SOC 2 / ISO 27001 certification, an audit opinion or legal advice; we hold no certification not listed here.
Sanctions lists and regulatory status change frequently; this page was last verified on October 25, 2026.