Network Requirements
A private deployment changes where the gateway sits in your network, not how your applications use it. This page shows the traffic paths and lists what to prepare.
Traffic Paths
Gateway Mode
Your applications call the gateway instead of the provider. Only the gateway reaches the model providers and ByteHide's classification service.
Your applications and agents
│ HTTPS (private connectivity or internal network)
▼
┌─────────────────┐ TLS terminates here. Management and
│ Load balancer │ development routes are blocked here.
└────────┬────────┘
│
┌──────────▼────────────── PRIVATE NETWORK ─────────────────┐
│ │
│ Gateway (replicas) ──┬──► PostgreSQL │
│ │ └──► Redis │
└────────┼──────────────────────────────────────────────────┘
│ only the gateway leaves the network
├──► ByteHide classification service (TLS)
▼
OpenAI · Anthropic · Bedrock · Azure · Vertex · … Your applications and agents
│ HTTPS (private connectivity or internal network)
▼
┌─────────────────┐ TLS terminates here. Management and
│ Load balancer │ development routes are blocked here.
└────────┬────────┘
│
┌──────────▼────────────── PRIVATE NETWORK ─────────────────┐
│ │
│ Gateway (replicas) ──┬──► PostgreSQL │
│ │ └──► Redis │
└────────┼──────────────────────────────────────────────────┘
│ only the gateway leaves the network
├──► ByteHide classification service (TLS)
▼
OpenAI · Anthropic · Bedrock · Azure · Vertex · …In-app Mode
Your applications keep their own connection to the provider and only ask the gateway for a verdict. In a fully in-app deployment, the gateway needs no outbound route to model providers, only to ByteHide's classification service.
Your application ──────────────────────► Model provider
│ (its own connection, with its native SDK)
│
│ verdict request
▼
Load balancer ──► Gateway ──► ByteHide classification service (TLS)
│
├──► PostgreSQL
└──► Redis Your application ──────────────────────► Model provider
│ (its own connection, with its native SDK)
│
│ verdict request
▼
Load balancer ──► Gateway ──► ByteHide classification service (TLS)
│
├──► PostgreSQL
└──► RedisThe verdict contract is the same as the gateway's: 200 clean, 403 blocked by a guardrail, 503 guard unavailable.
What You Provide
Dedicated Gateway
| Item | Description |
|---|---|
| Network ranges | The address ranges your applications and agents will connect from |
| Private connectivity parameters | For a site-to-site VPN: your peer addresses, encryption parameters and the ranges on each side, agreed with ByteHide. A second peer at another site can act as an automatic standby |
| Firewall rules | Allow your applications to reach the gateway's private address, and allow-list the gateway's fixed outbound addresses where your providers or MCP servers filter by source |
| DNS | Resolution of the gateway's private hostname from your network |
| Private MCP servers | The hostnames and in-tunnel addresses of the MCP servers the gateway must reach through the private connection, and your internal certificate authority if it issued their TLS certificates. ByteHide declares those addresses as the only private destinations the gateway may call |
Self-Hosted
| Item | Description |
|---|---|
| Cloud account | With permissions to create networks, databases, a cluster or machines, secrets and load balancers |
| Network design | Private subnets for the gateway, with outbound access to ByteHide's classification service and, in gateway mode, to your model providers |
| TLS and DNS | Certificates and hostnames for the gateway's load balancer |
Outbound Destinations
| Destination | Needed for |
|---|---|
| Model providers you configured | Gateway mode only. The gateway forwards to the providers in your integrations |
| MCP servers you connected | MCP protection |
| ByteHide classification service | Prompt classification, in every deployment option. Required: without it the gateway fails closed |
| ByteHide platform | Console management, notifications and SIEM forwarding. If you close this path, inspection keeps working: alerts are still evaluated and recorded, but notifications and SIEM forwarding do not leave |
By default the gateway only connects to MCP servers that resolve to public addresses, and the SaaS gateway always works this way. MCP servers on private addresses are reachable only inside private networks that the gateway's operator declares: ByteHide on a dedicated gateway, your team on a self-hosted one. Loopback, link-local and cloud metadata addresses are always refused. Use Approved MCP servers in Settings to restrict MCP connections further.
When the Guard Is Unavailable
The gateway fails closed by default: if ByteHide's classification service cannot be reached or cannot classify a request, the gateway answers 503 instead of letting the request through uninspected. Your clients should treat a 503 as an outage and retry, not as a detection.
Next Steps
Dedicated & Self-Hosted
How the private deployments are built
Gateway Mode
Integrate your applications