What does PaletteAI do, and what does Traefik Hub add?

PaletteAI builds and runs your AI infrastructure: GPU compute pools, a model catalog, and Model as a Service, in the cloud, the data center, and at the edge. Traefik Hub governs every call to those models. It names each person, app, and agent, decides which models and tools each may use, masks personal data, sets token limits, fails over when a model is down, and signs a record of every decision.

How does Traefik Hub govern AI agents?

Each agent carries its own signed token. The Traefik Hub MCP gateway shows each agent only the tools it may use and checks every tool call against that agent’s limits, so a support agent and a finance agent can share tools with different rights. Prompt injection is stopped before the model, and every allowed or refused call goes into the signed record.

Can teams share a gateway, or keep their own?

Each PaletteAI compute pool gets its own Traefik Hub gateway, with its own rules, limits, and signed record, and PaletteAI projects keep each team’s models apart. Rules live in Git, so the same policy can be applied to every pool. If you would rather run one shared gateway for several teams, we can design that with you.

How does Traefik Hub fit with Inference Launchpad?

Inference Launchpad is Spectro Cloud’s turnkey, local-first inference service, with its own routing, quotas, and metering. Traefik is its default gateway when it runs standalone, so teams that start with Launchpad already run on Traefik. As they grow into PaletteAI, Traefik Hub governs every model call through Model as a Service with the checks on this page.

Does it work in sovereign and air-gapped sites?

Yes, by design. Traefik Hub runs fully self-hosted inside each PaletteAI pool and has an offline mode for air-gapped sites. Rules are enforced on the pool itself, so checks keep working when an edge site loses its link to the center, and the signed record can be countersigned by a witness inside your own boundary.

Traefik Hub on Spectro Cloud PaletteAI

Inference Anywhere. Governance Everywhere.

PaletteAI runs your models anywhere. Traefik Hub governs every model and tool call on every pool, and proves it in a record your security team countersigns.

AI Gateway
MCP Gateway
Default Gateway for Model as a Service
Fully self-hosted
Policy as code

Request Demo

TRAEFIK LABS IS TRUSTED BY LEADING ENTERPRISES WORLDWIDE

The Challenge

Inference Anywhere Is Already True. Governance Everywhere Is Not.

Developers, AI applications, and agents call models in every place PaletteAI runs them. Each place has its own guardrails, partial ones, or none, and nothing proves what happened.

Developers, AI applications and AI agents each call models in six places: public cloud with provider rules only, data center with network rules only, AI factory where checks vary by team, edge sites where rules drift per site, sovereign sites with their own rulebook, and air-gapped sites with checks set by hand

They call every place. Every place checks them in its own way.

7 Questions every executive asks that no one place can answer.

01
Who is calling?
02
What may they do?
03
Is sensitive data leaking?
04
Are we overspending?
05
Will it stay up?
06
Can we prove what happened?
07
Can we change models without lock-in?

Traefik Hub answers all seven, wherever PaletteAI runs.

The Solution

One Gateway, Six Checks on Every Call to Every Model.

Every call from a person, app, or agent passes six checks in Traefik Hub before it reaches a model, on every PaletteAI pool, even at edge sites that go offline.

Every call from developers, apps and agents passes six checks in Traefik Hub before it reaches your models anywhere PaletteAI runs. Identify and Authorize: who is it, and what may they do? Every person, app, and agent is named, and each reaches only the models and tools it may use. Protect and Limit: is it safe, and is it affordable? Data is masked and attacks are stopped before the model, and token limits cap team spend. Fail over and Record: will it hold up, and can we prove it? If a model goes down, calls move to another, and every decision is signed, then countersigned.

How It Works

From First Deploy to Daily Operations

How a PaletteAI team puts the six checks in place, then runs them.

Day 0 | Platform team

Deploy. Governed From the First Call.

Traefik is the default gateway for PaletteAI Model as a Service. After a one-time setup, the project’s mapping pre-fills the Profile Bundle that turns on Traefik Hub.

All Six Checks, From the First Call

Pick a model in PaletteAI and deploy
The Profile Bundle brings Traefik Hub with it
The first call is already governed
Every policy in Git: plain YAML, versioned

Day 1 | AI agents and apps

Configure. Agents Only Get Their Tools.

A support agent and a finance agent use the same tools. Traefik Hub shows each agent only the tools it may use and checks every call against that agent’s own limits. The gateway, not the model, makes the decision.

Identify
Authorize
Protect

Set each agent’s tools and limits in one policy
Review every change as a pull request in Git
Sign people in with your identity provider

Same tools, different limits: Traefik Hub MCP Gateway identifies, authorizes, protects and records agent calls. The finance agent reaches Find order and Issue refund, the support agent’s refund over its limit is refused, and Delete user is hidden from both

Day 2 | Platform and security teams

Operate. And Prove What Happened.

Every decision goes into a signed record that a witness run by your security team countersigns. Models fail or change, clients keep the same endpoint, and the record stays unbroken.

Fail Over
Record

Run the witness that countersigns the record
Watch tokens, cost, and refusals per team
Pick the fallback model for each route

Traefik Hub signs every decision into an append-only record (call allowed, tool call refused, personal data masked) that a witness run by your security team countersigns

The Benefits

Govern Every Call Once. Unlock AI Across the Business.

Request Demo

Day 0
Put AI Anywhere the Business Needs It
One set of rules on every PaletteAI pool, even at edge sites that go offline.
Day 1
Let Agents Do Real Work, Safely
Each agent gets only its tools and limits. Personal data stays masked.
Day 1
Keep Every Team Within its Limits
Token limits per person, team, and agent from the identity on every call.
Day 2
Stay Free to Change Models
Swap a model with one change in Git and every app keeps working.
Day 2
Prove It to Your Auditors and Board
Every decision signed, then countersigned, by your own security team.

Platform teams don't want to approve and patch a separate gateway for every environment. With Traefik as the default in PaletteAI Model as a Service, the gateway ships with the platform. Customers who need identity-aware policy, data masking, and a signed audit trail add Traefik Hub without changing how they deploy.

Saad Malik

CTO and Co-founder, Spectro Cloud

Enterprises want to run AI wherever it makes sense, and they need the same guardrails everywhere it runs. With Traefik as the default gateway in PaletteAI Model as a Service, Spectro Cloud customers can add Traefik Hub and apply one policy to every model and agent call, with a signed record of every decision. That gives security teams the proof they need to move AI into production.

Sudeep Goswami

CEO, Traefik Labs

Frequently Asked Questions

No. They deploy and call models in PaletteAI as before, through Model as a Service. Traefik is the default gateway there, and after a one-time setup each model is governed from its first request.