Two products
Gate watches every agent from outside its loop. Flow runs the processes agents work inside. Both leave proof.
Gate sits on the path every model, MCP and A2A call takes out of your network. It checks each call against your keys, rules and detectors before it leaves, and signs a record of what it decided. Flow runs BPMN, CMMN and DMN as the standards write them, with an AI agent as one step in the process, and records each case so it replays against the definition that ran it.
In your network
Self-hosted: the control plane runs in your network. Neither product has a licence check, an activation step or a usage report, so nothing an agent touches reaches Kirto. The Trust Center lists every outbound connection each product makes, and each one is a connection you configure.
Built in Riyadh
Kirto is a Saudi company, and Gate ships control packs for the rules Saudi organisations answer to: the SAMA Cyber Security Framework, the Personal Data Protection Law, NDMO data classification, and SDAIA's AI ethics and generative AI guidelines. Gate's detectors recognise Gulf identifiers, and its guard models are measured in Arabic as well as English before one is pinned.
How we write about it
Every number on this site comes from a product repository or a published measurement, and the product and solution pages say what each product does not do. Gate's limits have a page of their own, held by its build to the threat model that ships with the binary.
Company details
Kirto LLC
Anas Bin Malik Road
Al Yasmin
Riyadh
Saudi Arabia
Sales and general questions: hello@kirto.com. Security reports: security@kirto.com.