Armortron9000 is a custom NAT gateway for your AWS VPC. Workloads hold placeholder values. Every outbound request is intercepted at the network boundary, the real credential is injected, and the request is forwarded. Nothing lives in your runtime.
How it works
Armortron9000 sits between your workloads and the internet. It intercepts every outbound request and injects real credentials only when policy allows — without your code ever touching them.
One CloudFormation stack or Terraform module. Armortron9000 becomes your VPC's NAT gateway. No code changes in your workloads.
Declare which real secrets attach to which external hosts in the Armortron9000 dashboard. Secrets are stored outside your VPC.
Replace real API keys with dummy strings in env vars or Secrets Manager. Your workloads start with no valid credentials.
Traffic routes through the gateway automatically via VPC routing. The gateway matches the destination host against your declared policy.
If the destination is allowed, the real credential is injected at the header level. Every decision is written to the audit trail with full context.
# terraform - armortron9000 gateway
module "armortron9000" {
source = "armortron9000/gateway/aws"
vpc_id = var.vpc_id
subnets = var.private_subnet_ids
}
# credential mapping (dashboard or IaC)
# api.stripe.com → STRIPE_SECRET_KEY (stored outside VPC)
# api.openai.com → OPENAI_API_KEY (stored outside VPC)
# workload env vars — no real values here
STRIPE_SECRET_KEY = "sk_placeholder_not_real"
OPENAI_API_KEY = "sk-placeholder-not-real"Security model
A compromised workload returns nothing useful. The real credentials never entered the process.
# stolen environment variables - worthless without the gateway STRIPE_SECRET_KEY="sk_placeholder_not_real" # real value: NOT PRESENT OPENAI_API_KEY="sk-placeholder-not-real" # real value: NOT PRESENT GITHUB_TOKEN="ghp_placeholder_not_real" # real value: NOT PRESENT # process dump, leaked log line, or stolen env var # returns nothing real. real credentials never entered this runtime.
A process dump, leaked log line, or stolen env var returns only placeholder strings. The real credentials never entered the runtime.
Use cases
Whether you're running serverless functions, containers, or AI agents, Armortron9000 intercepts every outbound request before it leaves your VPC.
Agents calling GitHub, npm registries, or model providers hold placeholder keys. The gateway injects the real token per-destination.
Serverless workloads calling Stripe, Twilio, SendGrid, or any SaaS API. No secrets in environment variables or SSM parameter store.
Long-running containerised services calling external data providers. Credential rotation happens at the gateway, not in container config.
GitHub Actions runners or CodeBuild jobs calling deployment APIs, package registries, or cloud services. Pipeline YAML contains no real credentials.
Why this is different
Env vars, Secrets Manager, IAM — every existing approach still puts credentials inside your workload at some point. Armortron9000 is the only layer where the credential never enters the process.
| Solution | No secrets in runtime | Works for 3rd-party APIs | Injection at network layer | Deny-by-default egress | Per-request audit log | No code changes required | Instant kill switch |
|---|---|---|---|---|---|---|---|
| Env vars / .env files | — | ✓ | — | — | — | ✓ | — |
| AWS Secrets Manager | — | ✓ | — | — | — | — | — |
| IAM roles | — | — | — | — | — | ✓ | — |
| HashiCorp Vault | — | ✓ | — | — | ✓ | — | ✓ |
| Armortron9000 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Only Armortron9000 provides injection at the network layer with full egress policy enforcement and zero secrets in the runtime.
Observability
Real-time visibility into every outbound request. See what your workloads are reaching, what the gateway allowed or blocked, and pull the kill switch in one click.
Total request volume
Requests mediated
Secrets in workload runtimes
Active destination mappings
Audit retention
One switch. Every injected credential revoked. Active requests drain; new ones are denied.
Pricing
Plans scoped by monthly forwarded requests and credential mappings. Every plan includes policy enforcement, deny-by-default egress, credential injection, and audit logging.
Start building with free compute credits.
For developers shipping with agents daily.
Shared controls for teams building together.
Governance, compliance, and dedicated support at scale.
Every plan includes policy enforcement, deny-by-default egress, credential injection, and audit logging. No hidden per-gateway fees.
Deploy the gateway into your VPC and eliminate credential exposure at the source.
Early access
We're onboarding companies in batches. Drop your email and we'll reach out when your spot is ready.