BerriAI

• Cloud providers such as AWS, Azure, and Google could ship a comparable multi-model gateway with native routing, budgets, and guardrails inside platforms enterprises already pay for, removing the reason a team runs a separate LiteLLM proxy.
• LiteLLM concentrates every model credential in one gateway, and the March 2026 supply-chain attack that placed two malicious packages on PyPI showed that the release path itself can be compromised, so a repeat incident could push security teams toward a vendor with a longer clean track record.
• Most public proof is open-source adoption plus a handful of named users, and no audited revenue or customer count is disclosed, so if paid enterprise accounts stall a buyer cannot size the commercial business behind the free tool.
• The roughly 1.6 million dollar seed is small for an enterprise motion, and a better-capitalized gateway rival or a platform vendor could outspend BerriAI on enterprise sales and support before it raises again.
• The team shows no prior security exit, so an enterprise security review of a product that brokers every model credential may weigh the absence of a seasoned security leader against younger but security-pedigreed rivals.

BerriAI sells to the platform teams that have to give many developers access to many language models at once. LiteLLM frames the problem as the friction of calling 100-plus providers, each with its own API shape, while tracking cost, enforcing budgets, and controlling who can call what. The product translates every provider into the OpenAI request and response format so a team writes against one interface instead of many.

The pain is documented by the buyers, not only the vendor. The company page states that Netflix uses LiteLLM to give developers Day 0 access to new models, and a named Lemonade principal architect describes the relief from managing multiple models in his own words. That is a buyer who owns the problem describing it directly.

The category demand is broad and developer-led. Y Combinator describes LiteLLM as an open-source LLM gateway used across named enterprises, and the repository draws tens of thousands of stars, which shows the routing-and-governance problem is felt widely rather than argued by one vendor. [s1, s6, s3]

LiteLLM ships as both a Python SDK and a proxy server that acts as the gateway in front of model providers. The GitHub project describes calling 100-plus LLM APIs in the OpenAI format with cost tracking, guardrails, load balancing, and logging, and the docs walk through standing up virtual keys and a first request. The same gateway adds budgets, rate limits per key and team, and routing across providers.

The security features live alongside the routing. The product offers guardrails that screen prompts and responses, including PII handling and prompt-injection checks, and the enterprise tier adds SSO, JWT auth, and audit logs on top of the open-source core for a self-managed deployment. BerriAI sells the enterprise tier to organizations giving model access to a large number of developers.

The open repository is the external validation a buyer can inspect. Roughly 52,000 stars, 9,300 forks, and a large contributor base under the MIT license, with the enterprise directory separately licensed, let a security or platform team read the code and the release history directly, a different assurance model than a closed gateway offers, and the docs portal documents the providers and the proxy setup beyond marketing claims. [s3, s4, s5, s11, s12]

LiteLLM competes as the open-source default in a gateway category that closed vendors and cloud platforms also contest. Portkey and Cloudflare market their own AI gateways with routing, caching, and guardrails, Kong brings API-gateway heritage to the same job, and the major cloud providers ship native model routers. LiteLLM's edge is an install base and a provider-coverage breadth that a closed competitor has to win one integration at a time.

The company's structural advantage is depth in the call path rather than a data moat. Because the gateway brokers every model request and holds the keys, replacing it means re-plumbing each integration, which raises switching cost above a point tool, though that advantage comes from adoption rather than proprietary data that a rival could not assemble.

The bundling threat comes from the platforms above LiteLLM. The same cloud providers whose models LiteLLM routes can offer a gateway inside the bill an enterprise already pays, and that is the bet a buyer weighs when deciding whether to standardize on an independent open-source layer rather than a platform-native one. [s3, s6, s2]

BerriAI shows the named-customer proof that open-source companies usually lack. The company page names Netflix as a user and carries a quote from a Lemonade architect, and Y Combinator lists Rocket Money, Samsara, and Adobe among LiteLLM users, references that appear across more than one source rather than as anonymous testimonials. Converting free adoption into named enterprise use is the step that most OSS-first tools struggle to reach.

The developer base underneath that is unusually large. The repository carries roughly 52,000 stars and 9,300 forks with a broad contributor base, and the package draws hundreds of millions of downloads a month. Those downloads suggest a large developer funnel for the paid enterprise tier.

Commercial scale beyond adoption is undisclosed. BerriAI raised about 1.6 million dollars in 2023 and sells an enterprise tier, but no audited revenue figure, paid customer count, or follow-on round appears in the public record, so the size of the business behind the free tool stays unverified. [s1, s6, s7, s10, s4]

BerriAI was co-founded by Krrish Dholakia and Ishaan Jaffer, who built LiteLLM into one of the most widely used open-source AI gateways. The Economic Times reported the two founders and the company's 2023 raise, and Y Combinator backed the company in its 2023 batch, which is verifiable founder and accelerator signal.

The artifact itself is the strongest evidence for the team. A gateway with tens of thousands of GitHub stars, thousands of forks, and a large contributor community is a demonstrated ability to build and sustain widely used infrastructure, which the public repository documents directly.

What the public sources do not show is in-domain security pedigree. Neither founder shows a prior security exit or a sustained security publication record of the kind that lifts the strongest teams in this category, which matters for a product that brokers every model credential an enterprise routes through it. [s7, s3, s4]

The March 2026 supply-chain incident is the defining trust event in LiteLLM's record. Attackers published two malicious packages, litellm 1.82.7 and 1.82.8, to PyPI, and Wiz called LiteLLM the latest victim of the open-source attack spree it tracks as TeamPCP. The poisoned versions were live for roughly 40 minutes before PyPI quarantined them, and BerriAI reported that users running the official Docker image, which pins dependencies, were not affected.

BerriAI's response is the readiness signal a buyer should weigh next. The company published a detailed incident page, added verified-safe versions with checksums, and rebuilt its release pipeline into a new CI/CD pipeline with isolated environments and stronger security gates before shipping a clean version. That is a concrete remediation rather than a denial, though it follows a real breach of the release path.

The structural trust question is inherent to the product's place in the stack. LiteLLM concentrates every model credential and inspects all model traffic, so a security review will ask for the audit reports, the data-handling terms, and evidence that the rebuilt pipeline holds, and the incident makes that scrutiny more likely rather than less for a small, young vendor. [s8, s9, s2]

Add analyzed competitors to compare them side by side with BerriAI.

BerriAI sells to the platform and machine-learning teams that hand many developers access to many models at once. LiteLLM frames the buyer as the team giving model access across a large number of developers and projects, and the enterprise page repeats that framing, so the segment is the company that has outgrown ad-hoc per-provider integrations and needs one governed entry point.

The same product serves two adopter shapes from one codebase. A developer can install the open-source proxy for free, while a larger organization buys the self-managed enterprise tier for SSO, audit logs, and key management. That free-to-paid path lets BerriAI land bottom-up inside engineering and expand into the procurement-gated account without a separate product.

Named demand reaches well past startups. The homepage carries on-record use from Netflix and Lemonade, and Y Combinator lists Rocket Money, Samsara, and Adobe among companies that trust LiteLLM, so the buyer set spans large consumer-internet and insurance engineering organizations. The open question is how much of that adoption is the free proxy rather than the paid tier, which the public record does not separate.

LiteLLM translates 100-plus model providers into one OpenAI-shaped interface so a team writes against a single API instead of many. The GitHub project describes a production gateway with virtual keys, spend tracking, guardrails, load balancing, and an admin dashboard, and the proxy adds per-key and per-team budgets and rate limits on top of the unified call path.

The security capabilities run inside that gateway rather than beside it. The proxy can screen prompts and responses for PII through Presidio and run prompt-injection detection, with pre-call and post-call moderation hooks available in the open-source proxy, while model-level guardrails and key or team-scoped guardrails are enterprise features. That places policy enforcement at a chokepoint gateway-mode requests pass through. The durable advantage is adoption and provider breadth, not a model edge. The guardrail backends run on third-party services such as Presidio, Lakera, and Bedrock that any rival can also license, and no named non-public dataset appears in fetched sources. What a competitor cannot copy by writing software is the install base that already routes through LiteLLM.

BerriAI's visible motion is developer adoption. The open-source proxy is free and self-serve from GitHub, the repository carries tens of thousands of stars and thousands of forks since its 2023 creation, and the Y Combinator jobs list shows open roles, an enterprise sales motion being built. Whether teams running the free repository become paying customers is not documented in the cited record.

Named enterprise use is the strongest conversion signal in the record. The homepage names Netflix and quotes a Lemonade architect on the record, and Y Combinator lists Rocket Money, Samsara, and Adobe among companies that trust LiteLLM, references that appear across more than one source rather than as anonymous testimonials. Turning free adoption into named production use is the step that separates BerriAI from the typical open-source project.

Commercial scale behind the adoption stays undisclosed. BerriAI reports a 1.6 million dollar seed raised from Y Combinator, Gravity Fund, and Pioneer Fund, a financing Economic Times reported as planned in August 2023, and it sells an enterprise tier through a contact-sales motion, but no audited revenue, paid-customer count, or follow-on round appears in fetched sources, so the size of the business behind the free tool is unverified.

BerriAI publishes a clear two-tier structure rather than hiding price entirely. The open-source tier is listed at zero dollars with the full provider coverage, virtual keys, budgets, and guardrails, while the enterprise tier is contact-sales with custom SLAs, SSO, audit logs, and a 30-day trial. The free tier is the unit that drives adoption and the paid tier is where the company captures revenue.

What the enterprise tier charges by stays private. The page invites a buyer to request pricing rather than naming a meter such as developers, projects, request volume, or seats, which fits a negotiated enterprise deal sized to each organization. The published-then-gated split tells a buyer the free proxy is meant to pull teams in before any sales conversation.

The inferable belief is that buyers pay for governed access at scale, not for the routing itself. The free tier already carries the routing and the guardrails, so the enterprise tier prices the controls a large organization needs around them, SSO, audit logs, key rotation, and support, rather than the core gateway function.

LiteLLM delivers as self-managed software on its open-source and enterprise paths, plus a hosted option. A developer can self-host the open-source proxy for free, a larger organization runs the enterprise edition as a self-managed deployment in its own cloud or on-premises environment, and the site advertises a hosted proxy, with LiteLLM Cloud users identified as a deployment group in the March 2026 incident update. The tiers ship the same routing, virtual keys, budgets, and guardrails.

The release pipeline is the operational fault line the product exposes. After the March 2026 supply-chain incident, BerriAI rebuilt releases onto a new CI/CD pipeline with isolated environments, stronger security gates, and safer release separation, and it points enterprises toward the pinned Docker image whose dependency locking spared customers during the attack. The company has also published a long-running release-validation system it describes as 24-hour load tests, built to catch regressions before they reach users.

On the self-managed paths the customer's own platform team operates the deployment while BerriAI provides the code, the release artifacts, and enterprise support, and the hosted proxy shifts that operation to BerriAI. Either way delivery sits at the software level rather than an analyst-staffed accountability service.

The March 2026 supply-chain attack is the defining trust event in LiteLLM's record. Attackers published two malicious packages, litellm 1.82.7 and 1.82.8, to PyPI, live for about 40 minutes by LiteLLM's account, while Wiz reports publication at approximately 8:30 UTC and quarantine at 11:25 UTC, nearly three hours, a conflict the record leaves open. Wiz called LiteLLM the latest victim of the open-source attack spree it tracks as TeamPCP. BerriAI said it believed the compromise originated from a poisoned Trivy dependency in its CI/CD scanning workflow, a PyPI advisory relayed by Wiz identifies an API token exposed via the prior Trivy incident as the root cause, and the company reported that customers on the pinned Docker image were not affected.

The response is the readiness signal a buyer should weigh next. BerriAI published a detailed incident page, shipped a clean version through a rebuilt CI/CD pipeline with isolated environments and stronger gates, and verified no malicious code reached the main branch. That is concrete remediation rather than denial, though it follows a real breach of the release path for a product that holds privileged credentials.

Formal compliance collateral is vendor-claimed, self-displayed, and internally inconsistent. LiteLLM's data-security page lists SOC 2 Type I and ISO 27001 as certified and SOC 2 Type II as in progress with a certificate expected by April 15, 2025, a date already long past when the page was reviewed, while a March 2026 post says the company is partnering with Vanta to recertify SOC 2 Type 2 and ISO 27001 and is still identifying independent auditors to verify its posture. A buyer reading only these pages cannot tell which attestations are current, and the reports themselves are available on request rather than published.

These are commercial certifications rather than a federal authorization, so an enterprise security review of a gateway that can centralize access to provider credentials and model traffic leans on those attestations alongside the open code, the incident response, and the enterprise controls.

LiteLLM is itself the gateway that applications and agents route through to reach any model, not a plugin on someone else's platform. The proxy is positioned as the central service a team points all model traffic at, which makes it infrastructure the rest of an organization's LLM stack depends on to function rather than an optional add-on beside a host platform.

That position is the source of both the switching cost and the bundling exposure. Because gateway deployments concentrate model requests and credentials, replacing one means repointing traffic and migrating LiteLLM-specific keys, budgets, routing rules, and guardrail configuration, friction that follows from the integration surface itself, though the cited record documents no completed migration, and the OpenAI-compatible interface it standardizes on may ease a move to another compatible gateway.

The exposure is that the platforms above LiteLLM route the same models. The cloud providers whose models LiteLLM proxies, and commercial gateway vendors, could bundle comparable routing, budgets, and guardrails natively, which would leave an independent open-source layer competing against routing a buyer already receives by default, though the cited record does not document specific substitutes or their commercial terms.

BerriAI's credibility comes from two founders who built widely used infrastructure. Krrish Dholakia and Ishaan Jaffer co-founded the company, took it through Y Combinator in 2023, and grew LiteLLM into an open-source gateway with tens of thousands of GitHub stars and thousands of forks, which the repository itself and Y Combinator's company profile document. The artifact itself, a gateway with tens of thousands of GitHub stars and thousands of forks, is the strongest evidence for the team.

The funding and accelerator signal is real but early. The company reports a raised 1.6 million dollar seed with Y Combinator support, which Economic Times covered as planned in August 2023, a credible seed for an open-source motion, though no later disclosed round appears in fetched sources, and the Y Combinator page lists open roles, active enterprise-facing hiring.

What the cited record does not show is in-domain security pedigree. It does not establish a prior security-company exit or a sustained security publication record for either founder, which matters for a product whose deployment and release path can centralize access to provider credentials and model traffic, and the March 2026 incident raises that bar rather than lowering it.