The AI agent platform your team controls.

SecondStack gives your company personal, project and named AI agents, and gives your team the controls: who signs in, which models each team may use, whose budget pays and a record of every run. It runs where you decide.

Book a demo How the gateway works

What your platform team controls.

  • Sign‑in and access

    People sign in with SSO through Entra ID, Keycloak or another OpenID Connect provider, or through LDAP and Active Directory, and SCIM keeps your users in sync. LLM access control is deny by default: you allow models per team, person, key or named agent.

  • Your providers, your keys

    You connect the AI providers you already use, on your own accounts: we do not host or resell models. Every call goes through one LLM gateway.

    SecondGate, the gateway 

  • Budgets and records

    Every agent, person and key has a budget, and alerts go out at the threshold you set. Every run leaves a record of what started it, what it could reach and what it cost.

    ControlTower, the admin console 

What you don't have to build.

You bring the servers, your identity provider and your AI provider accounts.

  • Directory groups and offboarding

    Directory groups grant access, admin rights and team membership. Anyone deactivated or deleted there loses access here too. A local break‑glass password still lets admins in when your identity provider is down.

  • Keys for people, apps and agents

    People create their own keys and pick the team each one charges to. Apps get organization keys with optional caps. A named agent gets its own key and never borrows a person's.

  • An audit history nobody can edit

    Admin and configuration changes go into an append‑only history that the database refuses to update or delete. Agent runs have their own record in ControlTower's Agent Activity, with tokens and cost for each model call.

  • Tool credentials the agent never sees

    Tools run in an isolated workspace, and the credentials for connected accounts stay in a separate egress proxy. Block a named agent's internet access, and it keeps only the connections you chose for it.

What your people get.

A personal agent for each person, project agents for shared workspaces and named agents hired for one role, in the web app and in Slack.

Meet the three kinds of agent 

How a pilot goes.

One team first. Until you add the next, no other team can reach a model or see an agent.

  1. Install with us

    In your cloud or on your own servers.

  2. Connect sign‑in

    Link your identity provider, add SCIM if you want it, and choose which directory groups get access.

  3. Allow models, set budgets

    Allow models for the pilot team only, and give it a budget, alert thresholds and a team lead.

  4. Turn agents on for that team

    Connect the accounts and MCP servers its agents will use.

  5. Watch, then widen

    Follow spend and run records in ControlTower. When you are ready, give the next team the same models and agent access, plus a budget of its own.

Questions platform teams ask.

Where does SecondStack run?
SecondStack runs where you decide. It is self‑hosted today, in your own cloud or on your own servers, and managed SaaS and AWS Marketplace are coming. Self‑hosted, every chat, file and run record stays in your environment.
Which identity providers does SecondStack work with?
SecondStack works with Entra ID, Keycloak and other identity providers over OpenID Connect, and with LDAP and Active Directory. SCIM keeps your users in sync, and people sign in once for the web app and ControlTower, the admin console.
Which AI model providers does SecondStack work with?
SecondStack works with Anthropic, OpenAI, Google and models you host yourself, through your own provider keys. We do not host or resell models, so your providers bill model usage on your own accounts.
How do agents reach our internal tools and data?
An admin turns on each connection in ControlTower. Google Workspace, Microsoft 365, GitHub, Jira and Notion are built in, and any MCP server or REST API connects by its URL. For an MCP server inside your network, the admin first adds a private‑network route.
How do we stop an agent, a key or a person?
An admin pauses an agent from ControlTower, and its owner can also pause or delete it in the web app. A deleted key is retired in SecondGate and logged in the audit history. When an admin blocks a person, their sessions end and every key they own stops working.
Can we keep the configuration as code?
Yes. Providers, models, teams, keys, guardrails and connectors can live as YAML files in your own git repository, which SecondStack imports. Adding the next team is then a change to those files.

The same platform, seen from another team

IT & security Where it runs, what leaves and who can do what. Business teams What agents do for your team every week. Finance Spend you can see, cap and explain.

Bring your identity provider and one pilot team.

On the demo call we show how SecondStack would run for that team: sign‑in, the models it may use, its budget and the record of every run.

Book a demo