Question 1

How is my data isolated from other tenants in NemoRouter?

Accepted Answer

Every NemoRouter tenant has a single UUID — the organization ID — that flows unchanged through Nemo's nemo schema, LiteLLM's public schema, request logs, and Stripe metadata. There are no mapping columns and no sync layers. Every Nemo table has row-level security enabled with policies scoped to the authenticated user's organization membership. Virtual keys are scoped at three levels (organization, team, key) and a request authenticated by a virtual key can never read or modify another tenant's data.

Question 2

How do my teams sign in to NemoRouter and what roles exist?

Accepted Answer

Authentication is Supabase Auth — email + password, magic link, and OAuth. Every user belongs to exactly one organization, enforced by a unique database index. Within an organization, every user belongs to exactly one team (Default is auto-created on signup). Four roles cover the surface: owner (billing + delete-org), admin (members + budgets + keys), member (use the product), viewer (read-only). SCIM and SSO are available on Enterprise.

Question 3

How does NemoRouter cap spend before it runs away?

Accepted Answer

Credits are the product. Every LLM call uses a reserve+settle pattern: NemoRouter estimates the cost, reserves it before forwarding to the provider, then settles the actual cost from LiteLLM's x-litellm-response-cost header. Balances cannot go negative. On top, per-key, per-team, and per-organization RPM/TPM ceilings plus monthly budget caps with notifications apply. The platform fee — 4% Tier 1, 2% Tier 2, 0% Tier 3 — is charged on top of credit purchases, never deducted from the credit amount.

Question 4

What observability and audit does NemoRouter provide?

Accepted Answer

Every request lands in a 90-day rolling log with status, latency, prompt + response (subject to data policy), the exact model that served the call, and the cost as reported by the provider. Logging callbacks fan out to Langfuse, Datadog, S3, or Slack in real time. An immutable audit log records every key creation, role change, member invitation, budget change, and organization-level setting change. Data policy is configurable per organization: zero-log, metadata-only, full, or full-with-PII-redaction.

Question 5

What guardrails does NemoRouter provide?

Accepted Answer

Guardrails are always in the request path when enabled — there is no advisory mode. Built-in guardrails cover content safety, PII detection and redaction, keyword blocklists, and prompt-injection detection. Each guardrail can be scoped at organization, team, or key level; key-level rules override team-level, which override organization-level. Blocked requests never spend credits and never appear in the provider's logs. Custom guardrails are available on Enterprise.

Question 6

What happens when an LLM provider is down?

Accepted Answer

Every model can declare a fallback chain — an ordered list of equivalent models from other providers that LiteLLM tries when the primary returns 5xx, rate-limits, or hangs past the timeout. Fallbacks are evaluated per-request, so a 30-second OpenAI outage degrades gracefully to Anthropic without application code changes. Production deploys roll forward via canary: 5% of traffic for 20 minutes against SLOs, with autonomous rollback if any SLO breaches.

	NemoRouter	OpenRouter	Portkey	Helicone
Platform fee	4 / 2 / 0%	5% flat	per-feature	per-event
Multi-tenancy + RLS	✓	—	workspace-only	workspace-only
Virtual keys + budgets	✓	—	paid	—
Guardrails in path	✓	—	paid	obs-only
Reserve+settle credits	✓	post-paid	post-paid	post-paid
OpenAI-compatible API	✓	✓	✓	proxy-only

Why NemoRouter

One bill, one key

Spend you can trust

Safety and isolation

How we compare

Get started

On this page