Gatewatch is a Thai AI data governance platform for teams already using AI with contracts, customer data, code, tickets, and internal documents. It helps security, IT, compliance, and engineering teams see, control, and prove what happens before that data reaches AI tools, with detection tuned for Thai-language data and Thailand PDPA compliance.
Prompts · Files · Code · Contracts · Customer data
AI Control Layer
Inspects AI requests before exposure
Allowed
Redacted
Blocked
✕
Approved AI tools and workflows
Company AI requests & data
AI Control Layer
Inspects AI requests before exposure
AllowedRedactedBlocked
Approved AI tools & workflows
Why It Matters
Teams are already using AI with company data.
Someone asks AI to summarize a contract, debug code, rewrite a support reply, or analyze a forecast. But the input may contain client names, pricing, customer details, source code, financial assumptions, legal terms, or internal strategy.
When that data reaches AI without the right controls, the company may not know what was shared, or how to prove what happened.
Read The Data Leak Your Security Team Cannot See, a short guide to how sensitive company data enters AI through everyday work, why policies and approved tools are not enough, and what controls companies need before AI usage scales. Read it first, then check your own exposure.
AI data governance in Thailand and Singapore is moving from best practice to expectation.
Regulators in Thailand and Singapore now name the exact risks of sending data into AI, and the responsibility sits with your company, not your AI vendor. Gatewatch is the AI data governance and AI guardrails platform built for that shift, giving Thailand PDPA protection from AI and supporting Singapore MAS AI risk management.
Singapore: MAS
In November 2025, the Monetary Authority of Singapore (MAS) proposed Guidelines on AI Risk Management for all financial institutions: banks, insurers, fintechs, and payment providers. It names data leakage, prompt injection, and third-party AI tools as risks firms must govern directly.
Thailand: PDPA
Thailand's Personal Data Protection Act (PDPA) has been in force since 2022, with breach notification required within 72 hours. In February 2026, its regulator, the PDPC, issued draft guidelines applying those data-protection obligations directly to the development and use of AI.
And these rules are being enforced. In October 2025, Singapore's PDPC fined Marina Bay Sands S$315,000 after the data of 665,495 people was exposed and sold on the dark web. In 2024, Thailand's PDPC issued its first PDPA penalty, the maximum THB 7 million, against an online retailer that leaked customer data and had no data protection officer. Neither was an AI incident, but both show the cost of losing control of sensitive data, which AI makes easier.
Gatewatch gives you the visibility, control, and evidence regulators now expect.
How It Works
Gatewatch checks data before AI sees it.
When someone sends company data into an AI tool or workflow, Gatewatch applies controls first. It looks at what is being sent, identifies sensitive information, applies the right policy decision, and records what happened.
Detect sensitive data
Identify sensitive information in prompts, pasted text, files, API payloads, and AI workflows. Designed to recognize content written in Thai and Singapore and Thailand identifier formats, not only English.
Redact or block exposure
Apply AI guardrails that mask, remove, warn, block, or escalate risky content before it reaches AI, giving PDPA protection from AI across Thailand and Singapore.
Apply policy decisions
Use rules based on data type, user, team, workflow, sensitivity, or AI destination.
Create audit evidence
Record what happened, who acted, what decision was applied, and what proof exists.
Before Gatewatch
After Gatewatch
AI usage depends on policy and employee judgment.
AI-bound data is checked before it reaches AI.
Approved tools control the destination.
Gatewatch helps control the data entering AI.
Sensitive data may move unseen through prompts, files, or workflows.
Sensitive content can be detected, redacted, blocked, or escalated.
Evidence may be incomplete or missing.
Control decisions are logged so teams can prove what happened.
Gatewatch turns AI policy into enforceable data control.
Where It Fits
Gatewatch covers the AI gap your existing tools were not built for.
It does not replace your security stack. It controls the moment where prompts, files, and payloads carry sensitive data into AI.
DLP / CASB / SSE
Gatewatch
Built for
Data at rest, endpoints, network traffic, and app access
The AI request itself: prompts, pasted text, uploads, and payloads
Controls
Which apps and sites users can reach, and known data channels
What sensitive data enters AI, redacted or blocked before any provider sees it
Regional detection
Detection tuned mainly for English and Western data
Designed for Thai-language data and Singapore and Thailand identifier formats
Evidence
Network, file, and app-access activity
What was sent to AI, what was decided, and who acted
Those tools secure the network, endpoints, and app access. Gatewatch controls the data entering AI, and because it is tied to no single AI provider or security suite, your controls stay yours as the tools around them change.
Built for trust-sensitive companies adopting AI.
Gatewatch is built for companies where AI now touches sensitive data, and each team has a different reason to care. Their data often includes Thai-language content and Singapore and Thailand identifier formats that detection tools built mainly for English can overlook.
Leadership
Understand how AI is being used across the business and where data controls apply.
Compliance
Support audit requirements with evidence of what data was processed, inspected, and controlled.
Legal
Reduce exposure from unreviewed contracts, client data, or confidential documents entering AI systems.
Security
Gain visibility into what data is being sent to AI tools before a breach becomes the discovery method.
Privacy
Apply data minimisation and redaction before sensitive personal data reaches external AI providers.
IT
Manage which AI tools are in use, enforce access policies, and keep a log of what went where.
Engineering
Integrate inspection and policy enforcement without rewriting application logic or changing AI providers.
Operations
Keep business processes running with AI in the loop while maintaining control over what data is shared.
Internal Controls
Enforce consistent policy across every team using AI, not just the ones you know about.
For Engineering Teams
Route AI requests through Gatewatch before they reach external models.
Gatewatch works as an API-compatible AI gateway for AI features, copilots, internal tools, RAG workflows, and LLM-powered applications. It sits between your application and the external AI provider, keeping the request flow your team already knows while adding a layer of inspection, policy enforcement, provider routing, and audit logging before any sensitive data leaves the business.
Integration starts with a single endpoint change in your application code. From that point, every prompt, file upload, and data payload passes through Gatewatch before it reaches the model. Sensitive content is identified and either redacted or blocked based on the policies you define. Requests that clear policy are forwarded to the configured AI provider. Every decision about what was allowed, what was changed, and what was stopped is logged and available for review.
Where Gatewatch sits, and what it does with your data.
Gatewatch sits between your app and the AI provider, not inside the model and not a replacement for your app. Your app routes through its OpenAI-compatible API, so every request is inspected, checked against policy, and logged before sensitive data leaves the business.
What Gatewatch reads, and what it keeps
Read in memory, not stored
Gatewatch reads each request to inspect and protect it, then discards the content.
Stored by default, metadata only
The audit trail records which data types were found and what was decided, not the prompt or response.
Stored only if you enable it
Optional features can keep more, and even then as a data type and a hash, never the value.
How we handle your data
Never used for training
Your prompts, files, and payloads are never used to train Gatewatch or any AI model.
Separated by organization
Each organization is its own tenant, with policy and keys isolated by access controls.
Singapore-based
A registered Singapore company, hosted in-country. Self-hosting is on the roadmap.
Built by two people who watched this problem go unsolved.
Around thirty years of combined experience building software and running delivery for large, complex organizations, now focused on a single problem.
Working inside client projects, we kept seeing the same thing. As teams adopted AI, confidential files and sensitive information were quietly slipping into AI tools through ordinary, everyday work.
The usual response was a policy and a training session. But a policy only tells people what not to do; it can't control what actually gets shared. So the exposure kept happening, because nothing sat between the person and the AI to stop it.
Gatewatch is the tool we wished those teams had, so we built it from scratch to close exactly that gap.
Srinivas Kattimani
Co-founder · Engineering & AI
16 years in software engineering and AI, including work at Omise and Diakrit, where mishandling data is not an option.
Marek Sadowski
Co-founder · Product & Delivery
14 years running product and delivery inside large, complex organizations, including Avon, ABB, and Philip Morris.
AI Data Exposure Assessment
Get a scored exposure summary in 3 minutes.
A short, question-based check of whether your company can see, control, and prove what happens before sensitive data reaches AI.
The assessment covers the control areas that matter most: visibility, policy enforcement, sensitive-data handling, and evidence.
The assessment is question-based. It never asks for prompts, files, customer data, or source code.
What it checks:
✓
Can you detect sensitive data before it reaches AI?
✓
Can risky content be controlled before exposure?
✓
Can policies be applied by team or data type?
✓
Can you prove what happened later?
What you get: A scored exposure summary of where your AI data controls are strong, partial, or missing. Compliance teams use it to set a baseline before an audit or AI adoption review.
Example result
12/20
Developing Control
Your company has started building AI data controls, but important gaps may still remain.
The remaining issue is consistency. AI controls may exist in some workflows but not others, and you may not always be able to prove what happened for a specific prompt, file, or user.
Recommended next step:Identify where your controls are strong and where AI-bound data may still bypass inspection or evidence capture.
Questions teams usually ask.
Common questions from security, IT, compliance, and leadership.
Gatewatch is an independent AI Data Control Layer that helps companies control sensitive data before it reaches AI tools and workflows. It helps teams detect sensitive information, apply policy decisions, redact or block risky exposure, and create evidence of what happened.
Yes. Gatewatch is an AI data governance platform built for companies in Thailand and Singapore. Its detection is tuned for Thai-language data and for Thailand and Singapore identifier formats, and it is designed to support Thailand PDPA obligations and Singapore MAS AI risk management expectations by inspecting, redacting, and logging sensitive data before it reaches AI tools.
Yes. Gatewatch provides AI guardrails that inspect every request before it reaches an AI model. Guardrails detect sensitive data, prompt injection, and policy violations, then redact, block, warn, or allow the request based on your rules, and log the decision as audit evidence. The guardrails are designed for Thailand and Singapore, including Thai-language content and local identifier formats.
Gatewatch helps companies meet Thailand PDPA obligations when using AI by inspecting data before it reaches AI tools, redacting or blocking personal data, and recording what was detected and decided. This gives PDPA protection from AI by keeping sensitive personal data out of AI systems that are not authorized to receive it and by creating evidence of the controls that were applied.
Gatewatch inspects data in flight at the control point so it can detect, redact, block, or log sensitive content before it reaches AI. It records what was inspected, redacted, blocked, and allowed, and can present that history as audit evidence. Inspection and logging are configurable to your policies. The assessment itself never requires you to share any company data.
Gatewatch sits at the control point where company data moves into AI, on the request path between your applications and the AI provider. That covers AI features, copilots, internal tools, RAG workflows, and other LLM-powered applications whose requests route through Gatewatch.
No. Gatewatch is designed for safer AI adoption, not blanket AI blocking. The goal is to let employees use AI productively while applying the right controls when sensitive data may be involved.
Your DLP, CASB, SSE, and cloud security controls do important work, and Gatewatch is built to sit alongside them, not replace them. Those tools were designed to secure networks, endpoints, devices, and which apps and sites people can reach. They were not designed for the moment a prompt, a pasted block of text, a file, or an API payload carries sensitive data into an AI tool. That is the gap Gatewatch closes: it inspects the request itself, redacts or blocks sensitive data before any AI provider sees it, and records what happened, across whichever models and providers you use. The quickest way to see whether that gap is open in your environment is the assessment or a short review.
Gatewatch helps create clearer evidence around AI data movement by showing what was detected, what decision was applied, and what happened before data reached AI tools or workflows. This can support security, compliance, privacy, audit, client assurance, and governance processes.
The assessment gives your team an exposure summary based on questions about AI visibility, control, and evidence. It helps show where your current AI data controls may be strong, partial, or missing.
The assessment is question-based and does not require company files, prompts, contracts, source code, customer records, or other sensitive material. It is designed to identify possible control gaps without asking you to upload confidential data.
You receive an exposure summary. If the result shows meaningful gaps, the next step can be a 30-Minute AI Data Exposure Review to interpret the result and identify practical control priorities.
To inspect, apply policy, redact, route, and return a result, Gatewatch reads the request in memory: prompts, messages, tool calls and results; files and images, including text read from them; and the model and routing settings, API keys or tokens, and the organization identity. It uses these in memory while it processes the request and does not store the content itself.
The default audit trail records what happened, not the content: which sensitive-data types were found, the policy decision that was applied, token counts and request metadata, and when each request happened. Full prompts are not stored by default, and responses are not written to the audit store.
A few optional features keep more, and only when you enable them: the built-in chat workspace saves conversations, uploaded files are kept for scanning, and richer logging is available for higher-risk events. Even then, detected findings are stored as the data type and a hash, never the value itself.
Get Started
Find out where your AI data controls are exposed before someone else does.
