The Kube platform
Built so the controls come first.
Both products run on the same foundation: one governed path in, one metered gateway to every model, one audit trail out. The controls are not a layer added at the end — they are the path itself.
Every request takes the same path.
There is no side door. A request from a browser and a request from a partner system pass the same gates, in the same order, and leave the same trace.
Users, then edge and WAF, then the API gateway, then the Studio runtime, then the AI and LLM gateway, then knowledge and data.
One isolation envelope.
Every capability runs inside the same governance perimeter. The design is aligned to BNM RMiT and PDPA expectations — described here as designed-against, not as a certification.
Zero-trust identity
Single sign-on, multi-factor, role-based access and managed identity. Nothing calls anything anonymously.
Hardened edge
One internet entry point with TLS termination, a web application firewall and DDoS protection.
Runtime isolation
Network policy and namespace isolation per project, so one team cannot reach another.
Sole-custody keys
Secrets and certificates held in a key vault you own, retrieved by managed identity, encrypted throughout.
Guardrails on both ends
Topical control and jailbreak protection on the way in; output filtering on the way out.
Audit and telemetry
Every invocation carries identity and a correlation identifier, and lands in the trace.
Model choice stays a configuration.
Application code never calls a model provider. It calls the gateway, which resolves the route, applies the quota, records the tokens and returns the answer. Changing model or provider does not change the application.
Callers — AI Chat, the Flows runtime, AI Docs and AI Dashboards — all reach models through one LLM Proxy, which applies model routes, quotas, pricing and audit before resolving a capability alias. No caller reaches a provider directly.
One design system, both products.
KUBE AI Studio and KubePass share the same tokens — the warm canvas, a single accent hue, FS Albert Pro, the same radii and the same motion timings. The accent re-themes per tenant; nothing else moves. This website is built from those same tokens.
Bring us your hardest constraint.
Data residency, an audit finding, a model that has to stay in your tenant. Tell us the constraint and we will tell you honestly whether we clear it.