Onyx Security and Smartflow are the same kind of product: a control plane that sits inline in the AI request path, enforces policy before a call executes, and records what happened. Both route across model providers. Both govern MCP tool calls. They diverge on where the control plane can run, on whether an agent gets an identity of its own, and on what the resulting record is built to prove.
The short version
This is the closest comparison on this site. Onyx describes itself as "the secure control plane for AI agents and models," ships an inline gateway with cross-provider routing and cost-aware model selection, proxies MCP traffic, and offers a self-hosted deployment. It raised $113M in July 2026 on top of a March emergence from stealth. Anyone evaluating a runtime control plane should have it on the list.
The differences that decide it are narrow and specific: air-gapped operation, agent identity as a first-class principal, and examination evidence for a named financial or healthcare regulator.
Feature Comparison
| Capability | Smartflow | Onyx Security |
|---|---|---|
| Enforcement point | Inline on the model request path. Policy evaluated before the prompt reaches the model. | Inline. "Inspects every prompt, tool call, and model response inline," with five enforcement actions: alert, block, mask, steer, or ask. |
| Deployment | On-premises, Kubernetes-native, air-gapped capable. | "Cloud, hybrid, or self-hosted options for sensitive data residency requirements," with AWS VPC, Bedrock Gateway and custom proxy configurations. Air-gapped operation is not documented. |
| Model routing | Routing and failover across 37+ providers including local models. | Routes "across LLMs to automate failover, minimize latency, and load-balance based on task complexity and cost." |
| Caching | MetaCache, a four-phase semantic caching engine using BERT-based similarity matching. Hit rates are workload-dependent. | No response caching, semantic or exact-match, is documented. |
| Agent identity | AIDA issues a cryptographic credential to the agent itself, scoped and revocable independently of whoever launched it. | Attribution rather than issuance: "correlates agent activity to the invoking user and the agent owner, and captures the identity used on each tool and MCP call." Identity context is pulled from Okta and Microsoft Entra. |
| MCP governance | MCP JSON-RPC gateway with tool caching, under agent identity. | "Proxy all MCP traffic with an inline gateway, log every request and response." |
| Framework mapping | FINRA 3110, HIPAA, SOX and EU AI Act, generated from enforcement records. | "Framework mappings for OWASP LLM Top 10, NIST AI RMF, MITRE ATLAS, EU AI Act, and ISO 42001 are applied automatically." FINRA, HIPAA and SOX are not documented. |
| Examination evidence | Examination packages and model inventory produced as a deliverable. | Automatic framework mapping plus SIEM forwarding to Splunk and CrowdStrike NG-SIEM. A generated examination package is not documented. |
| Audit retention | Customer-controlled. No vendor-imposed ceiling. | Records every prompt, response and tool call "by name, argument, and result." No retention period is published; the trust center lists a retention policy as available on request. |
| Certifications | Onyx publishes SOC 2 Type II, ISO 27001:2022 and GDPR at trust.onyx.security. | |
A note on the name. This page is about Onyx Security at onyx.security, the AI security company. It is not about the unrelated open-source enterprise search product at onyx.app, whose AWS Marketplace listing appears under the same word.
Where the control plane can run
Onyx documents cloud, hybrid and self-hosted deployment, and names AWS VPC and Bedrock Gateway specifically. That is a real answer to the data residency question and it removes the easy version of this argument: an enterprise that needs prompts to stay inside its own VPC has a path with Onyx.
What is not documented is air-gapped operation. For most buyers that distinction is academic. For a defense program running inside an accredited enclave, or a bank whose model-risk perimeter has no egress at all, it is the whole question — and it is not a feature that gets added late, because it constrains every dependency the product is allowed to have at request time. Smartflow's air-gapped deployment is a design constraint rather than a deployment option.
There is also a tension worth reading in Onyx's own documentation. The platform page sells an inline gateway; the Anthropic integration page says "No proxies. No agents. No disruption to how employees use Claude," with coverage delivered through the Claude Enterprise Compliance API. Both are true of different parts of the product, but a buyer should establish which architecture applies to which traffic before assuming uniform enforcement.
Whether the agent has a name of its own
This is the sharpest architectural difference, and it is easy to miss because both products talk about agent governance.
Onyx correlates agent activity back to the invoking user and the agent owner, drawing identity context from Okta or Entra. That is good observability and it answers "who is responsible for this agent." It does not make the agent a principal. The credential in play on a tool call is still a human's or a service account's, and the audit record inherits that identity.
AIDA issues the credential to the agent, scoped to what that agent may do and revocable without touching the person who launched it. Three things follow. An agent can be shut off without disabling an employee. An information barrier can be enforced against the agent as a party, which it cannot be against a principal the system cannot name. And a supervision record under FINRA Rule 3110 names the acting entity rather than the person whose key it borrowed.
Outside a supervision context, attribution may be all the governance a team needs, and Onyx's version of it is well built.
Framework mapping versus examination evidence
Onyx applies framework mappings automatically across OWASP LLM Top 10, NIST AI RMF, MITRE ATLAS, the EU AI Act and ISO 42001, so that "audit and regulator responses draw from the same policy record." That is a genuinely strong control-mapping story and it is broader across security frameworks than Smartflow's.
It is a different artifact from what a bank examiner asks for. An examiner does not request a control mapping. They request the inventory of models in use on a stated date, the policy in force at the time of a specific interaction, and the supervision record for the person or agent that acted. Onyx's documentation names no financial or healthcare regulator — no FINRA, no HIPAA, no SOX — and describes no generated examination package. Smartflow's examination suite exists to produce exactly that artifact from runtime records.
The honest framing: Onyx is mapped to the frameworks a CISO reports against. Smartflow is built for the evidence a supervisor demands. An organization with both obligations should ask each vendor to produce a sample.
Caching, and the cost conversation
Both products route on cost — Onyx does cost-aware model selection and load balancing by task complexity, which is a real lever. Neither the platform pages nor any other page on onyx.security documents response caching of any kind.
That matters because routing and caching cut spend differently. Routing sends a call to a cheaper model; semantic caching avoids the call entirely when the question has already been answered in substance. On enterprise traffic, where the same question arrives phrased a hundred ways, those are additive rather than alternative.
Where Onyx is strong
Onyx has the broadest surface coverage in this comparison. Discovery spans "every agent, MCP server, AI tool, copilot, and embedded AI surface" across SaaS, cloud, endpoints and code, and identity and device context is pulled from Okta, Entra, Intune, Jamf and Tanium. Its five enforcement actions include mask and steer alongside allow and block, plus a human-in-the-loop ask — a more granular response set than most of this market ships.
Its security-framework mapping is the most comprehensive on this page. It publishes SOC 2 Type II and ISO 27001:2022. It has moved quickly — out of stealth in March 2026, $113M Series B led by Bessemer in July, an Anthropic integration in June — and it names CAVA and Antreas as customers. For an enterprise whose primary concern is the breadth of AI surfaces employees touch, rather than the depth of the regulatory record, Onyx is a serious answer.
When to choose Smartflow
- Air-gapped operation: where there is no egress at request time and self-hosted in a VPC is not sufficient
- Agent identity: a credential held by the agent, not inherited from the person who launched it
- Examination evidence: packages and model inventory for FINRA, HIPAA and SOX, produced as a deliverable rather than mapped as controls
- Semantic caching: where the cost problem is repetition in meaning, not only model selection
Common questions
Can Onyx Security run on-premises? Onyx documents cloud, hybrid and self-hosted deployment with AWS VPC support. Air-gapped operation is not documented.
Does Onyx issue identities to agents? Not as documented. It correlates agent activity to the invoking user and the agent owner, and captures the identity used on each call.
Does Onyx do semantic caching? No caching of any kind is documented.
Which regulators does Onyx map to? OWASP LLM Top 10, NIST AI RMF, MITRE ATLAS, the EU AI Act and ISO 42001. FINRA, HIPAA and SOX are not documented.
Related reading
AI control plane guide · Agent governance · AI sovereignty · Examination readiness · All comparisons
Verified against each vendor’s published documentation in September 2026. Vendor capabilities change. If something here is out of date, tell us and we will correct it.
Onyx Security sources: onyx.security, onyx.security/platform, /platform/ai-orchestration, /platform/ai-security, /platform/ai-governance, /platform/ai-observability, /integrations/anthropic, /about, /newsroom, /blog/onyx-113m-series-b-keeping-humans-in-control-as-ai-becomes-smarter, trust.onyx.security.
Put this in the path of your own agents.
Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.
Request a Demo Read the docs