The short version
Kong is an API platform that learned AI. Kong Gateway is Apache 2.0 licensed, and its AI Gateway adds plugins and entities for LLM routing, prompt guards, token budgets, MCP servers and agent-to-agent traffic. It is managed through Konnect, Kong's cloud control plane, or run on your own Kong Gateway.
Sluis is built only for AI traffic. Every call is inspected for personal data, routed by an EU-first residency policy, sealed in a hash-chained audit log and metered against a budget. It also includes Sluis Workspace for employees, a product category Kong's gateway does not cover.
Sluis is not open source. It is proprietary, all rights reserved. If you want an open core with an existing plugin ecosystem, Kong is the stronger fit on licence alone. For the other gateways on the shortlist, see AI gateways for EU organisations compared.
At a glance
| Sluis | Kong AI Gateway | |
|---|---|---|
| Scope | AI gateway plus employee workspace | API, event and AI gateway platform |
| Licence | Proprietary, all rights reserved | Kong Gateway is Apache 2.0; several AI plugins are enterprise-only |
| Deployment | Managed, EU-hosted; self-hosted Edge (enterprise licence) | Konnect SaaS control plane, dedicated cloud gateways, or self-hosted data plane |
| Residency | Per-request policy, EU-only by default, optional EU-owned-only | Konnect control plane in a chosen geo (EU among them); where traffic goes depends on your configuration |
| PII | Built-in detectors, reversible pseudonymization | AI Sanitizer (enterprise): placeholder or synthetic replacement, optional restore, separate PII service |
| Budgets | Per workload, in real money, plus rpm and tpm | Consumer groups, token and cost budgets; AI Rate Limiting Advanced is enterprise |
| Audit | Hash chain, verifiable offline | Audit log, metrics exporters, OpenTelemetry |
| MCP | Governed through the same gate | AI MCP Server entities, OAuth2 scoping, aggregation |
| Price | Provider list price plus 10%, or €0.50 per 1M BYOK tokens | Konnect Plus from $25 a month plus usage; Enterprise custom |
Licence and hosting
Kong Gateway is Apache 2.0, with a large plugin ecosystem and Kubernetes support. Not every AI feature is free. AI Proxy and AI Prompt Guard carry no enterprise tag in the plugin docs, while AI Proxy Advanced, AI Rate Limiting Advanced, AI Semantic Prompt Guard and AI PII Sanitizer are listed as AI Gateway Enterprise.
Deployment is flexible. Konnect hosts the control plane, and you can run the data plane yourself or use Kong's dedicated cloud gateways. Kong's pricing page says a fully self-hosted setup, with both planes local, belongs to a separate Gateway Enterprise offering with custom pricing.
Sluis offers two shapes: the managed service, hosted in the EU, and Sluis Edge, one binary on your servers managed from the same console. Prompts do not transit Sluis's cloud with Edge, and provider egress still follows your policy. Edge needs an enterprise licence, flat per gateway per year.
Data protection
Kong's AI PII Sanitizer calls an external PII service that you run as a container, with models bundled per language. The images listed cover English, Spanish, French, German, Italian, Japanese, Korean, Portuguese and Turkish, and other spaCy models can be configured. It supports placeholder and synthetic replacements, custom regex patterns and optional restoration of originals in responses. Input sanitizing needs Gateway 3.10 or later, and output sanitizing 3.12 or later.
Sluis ships detection in the gateway: 60 detectors, including a national-ID pack that checksum-validates twelve EU countries, plus opt-in name recognition. A value becomes a stable token such as «EMAIL_1», restored at the single client egress. You can also block, mask or log, and name extra terms to remove on a single request. Detection is not a guarantee that every sensitive value is found. See data protection.
Routing and residency
Kong's strength is traffic engineering. AI Gateway balances across models with weighted round-robin and other algorithms, with retries and fallbacks, and lists semantic caching among its enterprise policies. Konnect control planes run in several geos, including the EU, and dedicated cloud gateways are available in listed cloud regions. That places the platform in a region. Which provider region a given request reaches depends on the models and providers you configure, and we found no jurisdiction or ownership policy for providers in the AI Gateway documentation.
Sluis enforces residency at the request. The default is EU-only, other jurisdictions are explicit, and the EU-owned-only restriction is separate, because an EU region does not imply an EU-owned provider. Responses disclose the route and model. Managed aliases such as sluis/auto resolve inside that policy. See residency.
Budgets and access
Kong organizes access with AI consumer groups: token budgets and cost budgets by team, department or pricing tier, with spend caps driven by identity claims. It also offers metering and billing if you resell AI access.
Sluis keeps one object, the workload, which owns rpm, tpm, a model allow-list and a total, daily or monthly budget shared by its keys, with an organisation cap above. Requests are priced from a live price book and debited before dispatch; past the budget the call returns 402 and never reaches a provider. See budgets and limits.
MCP and agents
Kong can turn an existing API into an MCP server, scope tool calls with OAuth2, aggregate tools and route A2A agent traffic. Sluis exposes a governed MCP gateway: tool grants are per key and deny-by-default, and each call is inspected, routed, sealed and metered. For coding agents, Sluis offers the native Anthropic Messages API and purpose-isolated agent keys for Claude Code, Codex and Cursor. Kong documents proxying Claude Code and Codex CLI as well.
Audit, performance and pricing
Kong documents audit logs, metrics exporters and OpenTelemetry spans for AI traffic; we did not find an offline-verifiable chain. Sluis writes every call to a hash-chained ledger and verifies it with audit verify-chain. Sluis is ISO 27001 certified.
Sluis measured its gate internally at about +1 ms at the median, and 9% lower throughput at synthetic saturation. The numbers are relative, from developer hardware, and we did not test Kong. See performance.
Kong lists Konnect Plus from $25 a month plus usage, with AI proxy usage charged per unique model, and a custom Enterprise plan billed annually. Sluis has no platform subscription, seat fee or free tier: list price plus 10% on managed models, or €0.50 per 1M tokens with your own keys, plus payment-method surcharges. See pricing.
When Kong AI Gateway is the better choice
- You already run Kong for APIs and want AI under the same control plane and plugins.
- You need event, API, MCP and A2A traffic governed in one platform.
- You want semantic caching, semantic prompt guards or prompt compression as policies.
- You need FIPS 140-3 support, or you resell AI access with metering and billing.
- You prefer an Apache 2.0 core you can extend with your own plugins.
When Sluis is the better choice
- Your main question is where each AI request may go and what was removed first.
- You want an EU vendor, EU hosting and an audit chain a regulator can verify offline.
- You do not want to operate a PII service, a database and a plugin stack.
- Employees need a governed workspace alongside the gateway.
FAQ
Is Kong AI Gateway open source?
Kong Gateway is Apache 2.0, and AI Proxy carries no enterprise tag. Many AI policies, including the PII Sanitizer and AI Proxy Advanced, require an enterprise licence or Konnect plan.
Can Kong redact personal data from prompts?
Yes, with the AI PII Sanitizer, an enterprise plugin that depends on a separate PII service container. It can restore originals in responses when you enable that option.
Is Sluis open source?
No. Sluis is proprietary and all rights are reserved. You can verify behaviour through its API documentation, console and audit chain, not through the code.
Can Kong keep AI traffic in the EU?
You can run Konnect in the EU geo and place gateways in EU regions. Keeping each request on EU providers is configuration you maintain, and we found no policy engine for provider jurisdiction or ownership in the documentation.
How does pricing compare?
Kong prices the platform: control planes, requests and, for AI, unique models, with enterprise on quote. Sluis prices usage: list price plus 10%, or €0.50 per 1M tokens with your own keys. Model your own volumes.
Can Sluis replace Kong for ordinary APIs?
No. Sluis handles AI traffic only. If you need a general API gateway, keep Kong for that.