Klyo Gateway
Product updates for Klyo Gateway, most recent first.
Subscribe via RSS.
- fix v1.25.5Single sign-on is preserved across upgrades
Upgrading no longer drops a configured single sign-on. An install coming from an older version with OpenID Connect set up could find SSO gon…
- feature v1.25.4Multiple identity providers with group-based access and roles
Single sign-on now supports more than one identity provider. LDAP directories and OIDC issuers are configured as a list, so staff in an Entr…
- fix v1.25.4Saved provider and Secure-LLM keys now apply across all pods
A saved provider or Secure-LLM API key now works on every pod. Previously a key was known only to the pod that handled the save, so another…
- fix v1.25.4Sign-in fixes for Entra, reverse proxies, and LDAP
Several sign-in paths are fixed. Microsoft Entra logins no longer fail with an unreachable-provider error: the signed identity token already…
- improvement v1.25.4Self-service certificate and secret management for single sign-on
Managing single sign-on credentials is now self-service. For Microsoft Entra, the gateway generates the sign-in certificate itself — create…
- improvement v1.25.4Single sign-on hardened with PKCE and strict token validation
Single sign-on is hardened. The authorization code exchange is protected with PKCE, and every endpoint is taken from the provider's own disc…
- feature v1.25.3Tamper-evident audit log with immutable off-site storage
The audit log is now tamper-evident. Every entry is sealed into a hash chain within seconds, the gateway refuses to change or delete entries…
- feature v1.25.2Administrator-curated web search groups
Web search sources can now be curated centrally. Under Admin → Web Search, an administrator groups trusted domains by topic — for example SA…
- fix v1.25.0The same question is never sent twice
Sending the same question twice is no longer possible. Pressing Send or Enter repeatedly while a slow response is pending now registers once…
- feature v1.25.0Web search in chat, on your organization's terms
A new Web button above the chat input lets the model answer with current information from the web, under your organization's control. The ga…
- security v1.25.0Web search stays within your policy
Web search runs only within your configured policy. Models that browse the internet on their own — Perplexity Sonar and similar self-searchi…
- security v1.24.0All open dependency advisories closed across the web and gateway images
The shipped web and gateway images are rebuilt to clear every open dependency advisory — 39 in total, spanning 18 high, 19 medium, and 2 low…
- fix v1.23.0Event dates no longer trigger false PII blocks
Clean prompts that anchor a date with "since", "seit", "depuis", or "waiting" no longer trip the PII gate. A date introduced this way is tre…
- improvement v1.23.0Model selection stays consistent across a conversation
Switching the model mid-conversation now sticks: regenerate, retry, summaries, and exports use the model you selected instead of reverting t…
- improvement v1.22.0Audit coverage and secret handling hardened
Several audit and secret-handling gaps are closed. Changes to IP allow and deny rules are now written to the audit log — the record was prev…
- improvement v1.22.0Blocked messages show exactly what to remove
When the gate blocks a message, the preview and block card now highlight every blocking span in your text and list each one as a chip with a…
- improvement v1.22.0Compliance report evaluates the running install
The compliance report now evaluates your running install instead of restating policy. Each GDPR, SOC 2, and HIPAA control is checked as a li…
- security v1.22.0Edited and regenerated messages now pass the full policy gate
Edited and regenerated messages now run the same checks as a new message. Previously both paths called the model provider directly, so an ed…
- feature v1.22.0PII Leak Report audits personal data in stored chat history
Administrators can now audit whether stored chat history contains personal data, where, and whose. A nightly job re-scans every stored messa…
- improvement v1.22.0PII detection stops flagging everyday text as personal data
PII findings are now split into proof — an e-mail, phone number, IBAN, card, key, an address with a street or postal code, or a date with a…
- fix v1.22.0Deleted content stays deleted on one retention schedule
Deleted content now follows a single, predictable schedule. The trash countdown shown to users, the nightly purge job, and the admin retenti…
- security v1.22.0Outbound webhooks can no longer target internal services
The guard that blocks webhook requests to internal and private network addresses now also runs on the admin Test button and on every webhook…
- improvement v1.21.1Redesigned A/B model comparison panel
The A/B comparison panel has a redesigned layout: elevated per-model cards with accent hairlines, a streaming skeleton and typing indicator…
- fix v1.21.1A/B comparison votes now reach the history
Fixed a bug where A/B comparison votes were silently discarded. The vote buttons sent display labels the endpoint did not accept, and the in…
- feature v1.21.0Built-in Prometheus and Grafana monitoring on Kubernetes
Kubernetes installs now ship Prometheus and Grafana in the chart, on by default, matching the Docker Compose monitoring stack. You get a Kub…
- improvement v1.21.0Pending PII appeal counts in the admin sidebar
The admin sidebar now shows a badge with the number of pending PII redaction appeals, so reviewers can see outstanding work without opening…
- improvement v1.21.0Refreshed provider model catalog in Quick-Add
The Quick-Add templates for configuring providers now offer each provider's newest generally available models, verified against the provider…
- fix v1.21.0Service Status page reports live health across all deployments
Fixed the admin Service Status page reporting a healthy gateway as down. The page probed a health endpoint the web proxy did not forward, so…
- fix v1.20.1Custom branding images now render
Fixed a bug where custom logo, favicon, and login-background images configured with external URLs were blocked by the content security polic…
- improvement v1.20.1In-cluster inference and the Klyo API companion on Kubernetes
Kubernetes installs now reach parity with Docker Compose. The chart deploys an in-cluster Ollama by default — a models volume and an idempot…
- improvement v1.20.0Firewall rule changes propagate across all replicas automatically
A firewall rule saved through one gateway replica now reaches every other replica, worker, and scheduler within seconds. The engine detects…
- feature v1.20.0Install Klyo Gateway on Kubernetes without Helm
Every release now ships a pre-rendered, credential-free Kubernetes manifest. Clusters that do not permit Helm can install the gateway with k…
- improvement v1.19.0Follow-up suggestion chips are now generated from your conversation
The follow-up chips shown after an assistant reply are now generated from the questions you have asked in the conversation, in your interfac…
- feature v1.18.0One-step production HTTPS with a bundled Caddy reverse proxy
A standalone Caddy reverse proxy now ships under deploy/caddy/, putting automatic Let's Encrypt TLS and your own domain in front of the Kube…
- fix v1.18.0Fix for a one-time pod restart during multi-replica Kubernetes installs
Fixed a bug where a gateway replica crash-restarted once on a fresh Kubernetes install when two replicas ran database migrations at the same…
- fix v1.18.0Fix for worker-log errors from two-factor code cleanup
Fixed a bug where the periodic cleanup of consumed two-factor (TOTP) codes failed on repeat runs with a database "operation in progress" err…
- fix v1.17.0Fix for a blank loading screen when opening the UI over plain HTTP
Fixed a bug where the web interface stayed on a blank "Loading…" screen when reached over plain HTTP. The browser was being told to upgrade…
- feature v1.17.0Deploy the full Klyo stack to Kubernetes with one Helm command
Self-hosted operators can now deploy the entire Klyo stack — gateway, web, worker, scheduler, database, Redis, ingress, autoscaling, and net…
- improvement v1.16.0Smart router learns from answer-version switches
The smart router's quality score now also learns from how you use answer versions. Switching to a version from a different model counts as a…
- feature v1.15.0Answer version history with switchable branches
Regenerating an answer or editing a question no longer discards the previous version. A version switcher appears under the message, so you c…
- improvement v1.14.1Chat actions now follow the message lifecycle
Message actions now respect whether a reply is still changing. While an answer is streaming or regenerating, its action toolbar is hidden, a…
- feature v1.14.0Klyo Prompt Coach suggests a stronger prompt before you send
Before a weak prompt reaches the model, the chat now offers to improve it. Klyo Prompt Coach scores prompt quality, lists the concrete gaps,…
- security v1.13.6Dependency security refresh and XXE protection on the changelog feed
Bundled dependencies are refreshed to absorb upstream security fixes: Jinja2 3.1.6, python-multipart 0.0.31, undici 7.28.0, DOMPurify 3.4.11…
- improvement v1.13.4Container images now ship for arm64 and amd64
Pre-built Gateway container images are now published for both linux/amd64 and linux/arm64. Operators deploying onto arm64 hosts — Apple Sili…
- feature v1.13.0Klyo Context Engine becomes the default PII classifier
The Gateway's content classification stage now uses the Klyo Context Engine by default — the trained multilingual model published as a separ…
- improvement v1.12.0Redesigned chat top bar and resizable sidebar
The chat top bar consolidates profile, admin, statistics, language, theme, and logout into a single account menu. The same menu and a clear…
- feature v1.11.1Default alerting with Prometheus rules and bundled Alertmanager
The gateway now ships with a default Prometheus alert rule set and a bundled Alertmanager service so a fresh install can page an operator wi…
- improvement v1.11.1Preflight validation and live startup visibility for self-hosted installs
make up now runs a preflight pass against the host before starting any container. The checks cover port conflicts, database password mismatc…
- feature v1.11.1Redacted diagnostics bundle for support cases
make support-bundle collects a single redacted tarball containing the artefacts most often requested during a support case: recent container…
- feature v1.11.1Verified database snapshot taken before every migration
Every schema migration now starts with an automatic, verified snapshot of the database. The snapshot is checksummed and a sample restore is…
- feature v1.11.0Automatic model fallback when a provider errors before the first token
If a model errors before it produces any reply content, the gateway now transparently retries the request against the next allowed model in…
- fix v1.11.0Cancelled replies, edit-regenerate, and provider errors now surface clearly
Three chat reliability fixes. Cancelling a reply mid-stream no longer leaves a spinner stuck on "Generating…" until reload. The bubble now r…
- feature v1.10.13Frontier model catalog refresh across Anthropic, OpenAI, and Google
The admin Providers page now lists current frontier models from the three major providers so they can be enabled without editing YAML. Added…
- security v1.10.12Hardening pass on firewall, egress, PII, and TOTP
Six safety-critical components received targeted hardening as part of the traceability gate that ships with every release. The firewall rege…
- improvement v1.10.11In-app changelog tab now reads the public release feed
The changelog tab inside the gateway no longer surfaces an internal engineering log. It now reads the public release feed at changelog.klyo.…
- security v1.10.10Closed login timing oracle and password-change race condition
Two authentication hardening fixes. The login endpoint previously took measurably less time to respond when the submitted email did not exis…
- improvement v1.10.10Verified-backup health endpoint and canary auto-rollback on SLO breach
Two reliability additions for self-hosted operators. The new /health/deep endpoint returns HTTP 503 when no SHA-256-verified backup complete…
- feature v1.10.9Safety evidence package shipped with every release
A signed safety evidence package is now attached to every gateway release. Customers deploying into regulated verticals — avionics, automoti…
- feature v1.10.8Appeal flow for false-positive PII redactions
End users can now report a false-positive redaction directly from the chat preview. Each finding on the preview banner exposes a "Report fal…
- improvement v1.10.7Unified routing for policy-flagged content with active-target visibility
When a Secure LLM or on-premise model is configured and the administrator opts in, content that would otherwise be blocked for policy reason…
- security v1.10.6Web framework upgraded to close RSC denial-of-service vulnerability
The bundled web framework is upgraded to close CVE-2026-23869, a denial-of-service vulnerability in Server Components endpoints where a craf…
- security v1.10.5Removed unused authentication library flagged by CVE-2026-27962
Removed an unused authentication library that customer dependency-scanners were flagging for CVE-2026-27962 — a JWT signature-verification b…
- improvement v1.10.3Secure LLM display name now shown in the chat attribution pill
The friendly display name administrators set for the Secure LLM provider — for example, "Our EU GPT-4o" — now appears under each assistant r…
- fix v1.10.2Hotfix for Secure LLM save returning a 500 error
Hotfix for v1.10.1. Saving a new Secure LLM provider on a self-hosted install returned a 500 error because the encryption master key generat…
- improvement v1.10.1Bundled on-premise model container is now opt-in
Self-hosted deployments without a GPU can now leave the bundled local-inference container out entirely, saving roughly 8 GB of resident memo…
- feature v1.10.0Secure LLM lane for policy-flagged content
Customers without on-premise GPUs can now nominate any trusted external or self-hosted model as the route for policy-flagged content. A new…
- fix v1.9.1.1Hotfix for strict Content-Security-Policy breaking the web UI
Hotfix for a regression introduced in v1.9.0. The strict Content-Security-Policy added during the security audit refused every framework scr…
- improvement v1.9.0Kernel egress firewall installs with no extra steps on supported hosts
The bootstrap script now auto-detects whether the host kernel supports the optional eBPF egress sidecar shipped in v1.8.2, generates the req…
- fix v1.9.0Login no longer hangs when LDAP is not configured
Fixed a regression where login could block for around 48 seconds on installs that did not have LDAP configured. The auth flow tried LDAP fir…
- improvement v1.9.0Local-inference runtime tunable from environment variables
Self-hosted operators can now tune the bundled local-inference runtime directly from .env. CPU and memory limits, the maximum number of conc…
- security v1.9.0Security audit closes backlog of vulnerabilities
A full-stack security audit has closed a backlog of vulnerabilities. Highlights include a command-injection fix in the backup-restore endpoi…
- feature v1.8.2Optional kernel-level firewall for outbound LLM traffic
A new optional sidecar enforces LLM egress directly in the Linux kernel via eBPF. The gateway authorizes each LLM call; without an authoriza…
- fix v1.8.1Hotfix for database extension version mismatch on first start
Hotfix for v1.8.0. Some self-hosted installs whose database had previously pulled a newer time-series extension via a rolling tag failed on…
- security v1.8.0Container hardening for self-hosted deployments
Self-hosted containers now run as a non-root user with a read-only root filesystem, no Linux capabilities beyond what bootstrap requires, an…
- feature v1.7.0PII detection expansion, admin approval gate, and on-prem fallback
Four new detection plugins ship by default: API keys and bearer tokens, employee IDs (including localized variants), client identifiers pair…
- improvement v1.6.8Pre-built container images for self-hosted installs
Gateway and web images are now published to a public container registry on every release, with :<version>, :<major>.<minor>, and :latest tag…
- fix v1.6.6Custom branding now applies across the entire chat and admin UI
Fixed a regression that limited admin-configured branding to the login page only. The configured logo, application name, and favicon now pro…
- security v1.6.5Bundled admin interfaces now bind to loopback by default
The bundled monitoring, identity, and routing interfaces (Grafana, Prometheus, Uptime Kuma, the proxy dashboard, the secret store, the direc…
- fix v1.6.4Self-hosted installs no longer require direct access to the gateway port
Fixed a class of "cannot reach the API server" failures on fresh self-hosted installs. The web tier now proxies all API calls to the gateway…
- security v1.6.2Firewall now strips invisible Unicode characters before keyword matching
Closed a bypass where zero-width, bidirectional-override, and soft-hyphen characters could split a blocked keyword and evade the firewall's…
- improvement v1.6.1Schema migrations now apply automatically on upgrade
Gateway now manages its database schema through a versioned migration system. On startup, the container detects the existing schema, brings…
- feature v1.6.0Klyo Marketplace integration for plugin discovery and reviews
Gateway can now connect to Klyo Marketplace to register the install, sync available plugins, and submit star-rating reviews from the admin c…
- feature v1.5.0Self-host licensing and tiered billing plans
Gateway now runs in two deployment modes behind a shared billing surface: managed SaaS and self-hosted. Self-hosted deployments validate aga…
- feature v1.4.0Monthly budgets and routing markup per LLM group
Each LLM group can now carry a monthly budget ceiling. When a group exceeds its budget, further requests are blocked with HTTP 402 until the…
- improvement v1.4.0Ten cloud LLM providers preconfigured out of the box
New deployments ship with ten cloud providers already registered in the catalog: OpenAI, Google Gemini, Azure OpenAI, Groq, Mistral, DeepSee…
- feature v1.3.0Plugin marketplace with search, categories, and ratings
The admin console now includes a plugin marketplace with search, category filters, star ratings, and customer reviews. Plugins install and u…
- improvement v1.2.0Multi-language firewall, IP allow/deny lists, and session management
The firewall now normalizes input with Unicode NFKC and evaluates rules across seven languages, closing bypasses that relied on alphabet swa…
- feature v1.2.0GDPR data export and configurable message retention
Administrators can now configure a retention window that auto-deletes conversations and messages after the set period. End users can downloa…
- feature v1.2.0Shared conversations with per-link permissions
Conversations can now be shared with individual users or with entire LLM groups, as view-only or edit. Shared links support an optional expi…
- feature v1.1.0Cost intelligence panel and routing decision log
The admin console now breaks down spend per model with trend indicators and an estimated savings figure against an always-cheapest baseline.…
- feature v1.0.0Klyo Gateway is generally available
Klyo Gateway is generally available. Traffic routes across LLM providers using one of four strategies — cost, quality, latency, or balanced…