> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/merge-gateway/security/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Security & Compliance

> Build once. Connect to every API, tool, and LLM. Ship products and agents to production without owning the integration stack.

## Docs

- [Roles and permissions](https://docs.merge.dev/merge-gateway/security/roles-and-permissions.md): The four built-in roles, the 36 permissions they bundle, custom roles, and how members get their role.
- [Multi-factor authentication](https://docs.merge.dev/merge-gateway/security/multi-factor-authentication.md): Setting up an authenticator app, requiring MFA org-wide, resetting a member's device, and how MFA interacts with SSO.
- [Audit trail](https://docs.merge.dev/merge-gateway/security/audit-trail.md): What Gateway records in the audit trail, the fields on each entry, and how to filter and export it from the dashboard.
- [Data loss prevention](https://docs.merge.dev/merge-gateway/security/data-loss-prevention.md): Gateway scans prompts against built-in and custom DLP rules before sending them to the vendor, then notifies, redacts, or blocks. Rules are managed in the dashboard.
- [Prompt injection protection](https://docs.merge.dev/merge-gateway/security/prompt-injection-protection.md): Gateway screens prompts for direct and indirect injection, alerts or blocks on detection, and redacts leaked credentials from responses. Covers modes, thresholds, allowlists, errors, and overrides.
- [Zero data retention](https://docs.merge.dev/merge-gateway/security/zero-data-retention.md): Restrict routing to vendors with zero data retention agreements, for the whole organization or per project and customer. Covers fail-closed errors, BYOK, and how to list eligible models.
- [Per-customer restrictions](https://docs.merge.dev/merge-gateway/security/per-customer-restrictions.md): Block or pin models and providers for specific customers, or for your whole organization, from the dashboard. Covers rule types, the 403 error codes, and how rules interact with routing policies.
- [Geo-location routing](https://docs.merge.dev/merge-gateway/security/geo-location-routing.md): Restrict which vendors serve your requests by country, region, or vendor, for the whole organization or per project and customer. Covers region tags, allow and deny lists, and the error when nothing matches.
- [Vendor terms](https://docs.merge.dev/merge-gateway/security/provider-terms.md): Every AI vendor Gateway routes to, with its terms of service and the country and region tags used by geo-location routing.