 Lombard Odier is one of Switzerland’s oldest and most respected private banks, founded in 1796. In addition to private banking and asset management, Lombard Odier also serves as a technology provider, offering “banking-as-a-service” solutions to other financial institutions. Its core banking platform includes over 800 components and has been undergoing a large-scale modernization over the past four years leveraging a modern stack built on technologies such as OpenShift, Kong, Kafka, Vault, and Consul. As part of this modernization, Lombard Odier is exploring how to integrate artificial intelligence (AI) into its operations while maintaining the highest standards for security, privacy, and compliance. 
  With the rise of AI across financial services, from fraud detection to client onboarding and portfolio optimization, Lombard Odier needed a way to support AI adoption securely and at scale. As a highly regulated organization, they had to ensure their use of AI models aligned with strict requirements around data protection, auditability, and accountability. AI posed several key risks. The use of external models increased the bank’s attack surface, and inconsistencies in model behavior introduced reliability and transparency concerns. There was also the challenge of scaling AI services for internal use while protecting sensitive customer data. The bank needed a solution that could enforce access controls, provide full observability into AI interactions, and protect against the accidental exposure of personally identifiable information (PII). 
  To address these challenges, Lombard Odier implemented Kong’s AI Gateway—a solution that allowed the bank to securely manage, monitor, and scale access to external AI services. By deploying Kong in Kubernetes with Kong Ingress Controller, the team enabled decentralized, self-service access to AI services, eliminating the need for manual setup by a central team. They established strict network controls using an egress IP and Kubernetes network policies to limit access to AI services only through the AI Gateway. Instead of distributing API keys across applications, Lombard Odier centralized authentication at the gateway, leveraging OAuth and OIDC to grant secure access while maintaining separation of concerns. They also introduced traffic management policies to control usage at the application level, ensuring fair and efficient resource consumption. One of the most innovative aspects of the solution was a custom-built AI Privacy Guardian plugin. This plugin detects and classifies PII in outgoing prompts, and depending on the data classification, it can tokenize sensitive fields before reaching external models or block the request entirely. When tokenization is used, the plugin re-maps the response to its original form, preserving the user experience while safeguarding privacy. The bank also used Kong’s AI prompt injection to inform models that tokens were present, ensuring the integrity of the interaction. With full integration into OpenTelemetry, Kong gave Lombard Odier comprehensive observability into all AI traffic. This made it possible to track usage metrics such as token counts and response reasons within their existing monitoring ecosystem. 
  Kong’s AI Gateway has enabled Lombard Odier to securely embrace AI without compromising on governance or compliance. The bank now benefits from greater control and visibility over its AI traffic, with clearly defined access permissions and detailed usage insights. The ability to tokenize or block sensitive data has significantly reduced privacy and reputational risks. Development teams can now integrate AI services through a secure, scalable, and compliant pathway helping the organization innovate faster while remaining aligned with regulatory standards. Looking ahead, Lombard Odier is exploring the integration of more advanced AI applications involving vector databases and multi-model workflows. With Kong’s AI Gateway in place, the bank is well-positioned to support this next wave of innovation in a safe and structured manner. 


Lombard Odier

Egress AI Gateways: Securely Integrating LLMs in Financial Applications

 The UK’s Department of Work and Pensions (DWP) is the country’s largest public service department, supporting more than 20 million citizens. From children and low-income families to retirees and bereaved families, DWP touches nearly every household in the UK. The department manages 800 million to 1 billion pounds in daily payments and has a staff of about 100,000 across the nation. When COVID-19 hit in early 2020, DWP became a critical support system for millions of citizens facing unemployment, illness, and uncertainty. At the same time, like most of the UK, DWP itself was impacted by the national lockdown with over half its operational staff unable to work on-site and limited remote capabilities in place. 

  The lockdown brought a surge in demand that DWP had never seen before. Nearly 3 million new benefit claims came in almost immediately, overwhelming a system that relied heavily on face-to-face and manual processes. These traditional methods were no longer viable due to social distancing and remote work restrictions. With offices closed and call centers overwhelmed, the department needed a new way to serve citizens safely and quickly. At the same time, demand for access to DWP data spiked across government departments. Other agencies urgently needed up-to-date information to support national logistics and health responses, such as delivering PPE and standing up temporary hospitals. DWP had to rapidly modernize and scale its digital infrastructure while ensuring service continuity for the people who needed help the most. 
  DWP accelerated its digital transformation through APIs and process automation, underpinned by Kong as its central API gateway. Running in AWS, the gateway provided the elasticity and scalability needed to handle soaring traffic and new service demands. A contract-first development mindset enabled teams to move quickly and work in parallel. The digital platform supported a hub-and-spoke architecture that simplified onboarding for internal and external partners across multiple cloud providers. Three key API use cases illustrate how this strategy played out during the crisis. 
First, to support the national supply chain, DWP enhanced an existing API that validated driver identities in partnership with the Driver and Vehicle Licensing Authority. As HGV drivers became scarce due to illness and self-isolation, the API helped get more trucks back on the road quickly. With Kong, DWP could safely increase throughput while protecting backend systems that were also handling millions of new benefit claims. Second, in response to 2.5 million Universal Credit applications in the first three weeks of lockdown, DWP created and deployed new APIs to automate the initial steps of the claims process. These APIs connected with backend systems and artificial intelligence tools, enabling automated eligibility checks and payment releases. As a result, 97% of claims were paid on time, consistent with DWP’s pre-pandemic key performance indicators. The remaining 3% required manual handling, but the overall system held strong. The APIs developed during this time remain in use today and continue to support other business lines as well. Third, DWP launched APIs to receive digital medical assessments for the roughly 500,000 citizens who submitted new claims due to health issues. Previously, these assessments were done in person and processed via physical paperwork. With offices closed and in-person GP visits curtailed, DWP worked with partners to accept medical documents through an API. Those documents were then routed through robotic process automation systems that mimicked keystrokes in legacy systems, allowing for straight-through processing. This blend of new APIs, AI, and RPA enabled the department to process claims efficiently and safely, despite relying on older back-end infrastructure. Kong’s gateway ensured visibility, protection, and throttling across all these services. The platform enabled shared access to reusable APIs across teams, reducing duplication and accelerating development. A centralized developer portal made it easy for teams to discover existing APIs and onboard quickly, even during periods of high stress. 
  In just the first three months of lockdown, DWP deployed 37 new APIs. API traffic grew dramatically. Daily API requests rose from 4.5 million to more than 7.5 million. Weekly traffic increased from 25 million to a peak of 40 million. Monthly traffic climbed from 100 million to over 160 million requests. All of this was supported by just two nodes running in AWS, demonstrating the strength and efficiency of the Kong API gateway. DWP maintained critical services without disruption, ensured on-time payments for millions of citizens, and enabled 25,000 agents to work remotely. These efforts not only met the demands of the crisis but also validated and accelerated the department’s long-term digital transformation strategy. COVID-19 proved the value of DWP’s API-first approach. The organization is now driving toward a more holistic, citizen-centered experience that goes beyond product-based service lines. During the crisis, many citizens had needs spanning multiple benefit programs, such as Universal Credit and child support. DWP is working to simplify these journeys by building shared components—such as payment engines, identity verification, and inquiry systems—that can be reused across departments. Future plans include deeper adoption of self-service capabilities, intelligent monitoring, and federated gateways aligned with cloud-native architectures. The team is exploring how to give developers full autonomy to mock, test, and publish APIs with minimal friction. By embracing contract-first workflows and continuous integration, DWP is setting itself up to deliver faster, more resilient services well beyond the pandemic. 


Connecting Our Country: How APIs Sit at the Heart of Our COVID-19 Response

 McAfee is a worldwide leader in online protection that focuses on safeguarding people, not just devices, through personalized privacy and security. McAfee's approach seeks to understand customer journeys and utilize data to drive engagement, product outcomes, and holistic, intelligent protections for safe online experiences. McAfee ingests high volumes of data from its services and applications to inform business insights and use cases — up to 150 megabytes per second from over 80 different sources. As McAfee's data volumes and sources continue to grow, it's critical for them to maintain a cost-effective and scalable data ingestion process. 

  “The question,” Koi said, “is how can we scale more cost-effectively as data volume increases and new data sources are added?”  McAfee had previously tried third-party managed ingestion solutions and found they had little to no control over their costs when scaling alongside data volumes and sources. This outcome prompted their decision to redesign the ingestion system using a combination of open-source and cloud technologies.  Beyond scalability and cost, McAfee also needed to redesign the ingestion system for better monitoring, alerting, and data enrichment capabilities within their ingestion layer. Additionally, their teams were seeking centralized gateway functions to ingest and serve data for their entire platform. 


  McAfee deployed Kong Gateway with a hybrid control and data plane architecture, reducing disruption, strengthening application security, and boosting development efficiency with increased configurability. On top of that, the hybrid deployment decreases traffic to the database since it only connects to the control plane and provides additional security by isolating the two planes. Kong's deployment leverages plugins to integrate with other systems, like McAfee's queueing solution. The plugin acts as an intermediary enrichment and messaging layer to handle data processing, including encoding or decoding traffic requests. Kong Gateway enables configurable multi-tenant deployment to meet McAfee's availability requirements across different data sources. Isolation between the data and control planes creates greater reliability because if one plane is down, the other can still process traffic by keeping tenants separate. Lastly, the Kong plugins allow teams to handle errors properly and transform responses before they get back to the client. By utilizing Kong Gateway and a distributed queuing system, McAfee can efficiently manage traffic, authentication, authorization, data processing, and storage. 


  Kong Gateway achieved low latency numbers and a high throughput of 150 megabytes per second for McAfee. On top of that, it resulted in a 50% cost reduction compared to previous ingestion systems. Kong has demonstrated that it flexibly scales to meet McAfee’s data volumes, and its microservices plugin model accelerates new use cases to serve emerging needs.  “We continue to monitor the system for areas that we can optimize to save more costs and to improve performance,” Koi said. McAfee saw more wins than just cost efficiency and scalability. The hybrid deployment with Kong was highly configurable, and its resource isolation increased reliability across multiple data sources. Additionally, its extensibility made innovation much more straightforward for development teams. Koi shared that, as with any other solution, there are changes to keep in mind when turning toward an ingestion system that uses open-source and cloud technologies. He advised development teams to be mindful of system upgrades that require migrating from one version to another. He also said teams should prepare for intentional infrastructure management, including system upgrades, node patching, and monitoring. Overall, migrating to a hybrid architecture with Kong skyrocketed performance and plummeted costs while adapting to McAfee’s specific needs: “It makes the whole deployment process highly configurable," Koi said. By jumping headfirst into a new hybrid ingestion solution using Kong, McAfee obtained the high-performing, cost-efficient, and scalable data ingestion capabilities they had been searching for. While no transition comes without growing pains, optimizing hybrid deployment opens the door for greater savings and efficiency over time.  As McAfee's data volume and source landscape continue to rapidly expand, the configurable Kong implementation will adapt to serve their unique consumer data needs. 









McAfee

Wisdom Koi

 "Overall, migrating to a hybrid architecture with Kong skyrocketed performance and plummeted costs while adapting to McAfee’s specific needs: “It makes the whole deployment process highly configurable."

How McAfee Leverages Kong Gateway for Data Ingestion at Scale

 Founded in 1949, Europcar began as a small rental car company in Paris. Over the last 70 years, Europcar has expanded to over 140 countries and serves millions of customers worldwide. Europcar is one of the main brands in the European Mobility Group (EMG or EMobG), Europcar has a fleet of 256,000 vehicles and employs more than 9,000 employees. In 2022, Europcar was acquired by the Volkswagen Group Consortium.  Due to Europcar's massive outreach across the globe, unifying control of APIs throughout all branches was a challenge. They were looking to streamline the API management process across all brands, systems, and regions to optimize their business and remove the inefficiencies between disconnected systems.  Security standards varied across the board depending on the branch. Without standardized API management, it became difficult to manage the various APIs and anticipate any issues that may arise. And when something did go wrong, troubleshooting became an ordeal. The newly formed API engineering team was given the difficult undertaking of streamlining the API process across the many parts of the company and needed to find a simple and effective way to unify the management process. 
  Kong Konnect was implemented to unify Europcar’s many systems. Kong Konnect allowed Europcar to easily connect all their Software as a Service (SaaS) content with any cloud/containerization applications.  Using the Admin API function of Kong Konnect, the team was able to easily document their APIs and publish them to developer portals, allowing APIs to be treated as a product. With Kong Insomnia, Europcar created a continuous integration and continuous development (CI/CD) pipeline and is able to generate declarative configuration from OpenAPI specifications.  With decK, the team was able to automate API documentation. The updating of the APIs through this new automated process is independent and intuitive, so users don’t need to input any additional changes or information. The result? More robust and consistent APIs. 
  With Kong, the team at Europcar and EMobG noticed several significant benefits to their company.  Move to cloud — Kong Konnect encouraged and aided in the team’s move to the cloud Set security standards and adopt best practices —  The streamlining of the API gateway and management process made it simple and effective to set security standards and best practices throughout all branches and systems.  Enable a developer portal — The developer portal implemented allowed for the seamless documentation and cataloging of all issues, changes, and usages.  Centralized observability and monitoring — Centralization of the monitoring and observing process for APIs made the system much more convenient and intuitive.  Delegated API exposure to project teams — Delegating specific APIs to specific teams became much easier to organize and keep track of. 

Europcar

How Europcar Streamlined API Management with Automation

 The London Stock Exchange Group (LSEG) is a leading global financial markets infrastructure and data provider. To support its internal developer and engineering teams across a range of business units, LSEG adopted Kong to manage and scale its API infrastructure. A dedicated Kong SME team was formed, led by product owner Kaja and solution architect Sureshankar. Together with three other engineers, the team supports automation, deployment, and customization of Kong across LSEG’s internal environments. 

  In early 2022, LSEG was deploying Kong images manually across customer environments. This process was time-consuming, inconsistent, and lacked visibility and standardization across teams. As adoption of Kong increased within the organization, the need for a streamlined, automated approach to building, securing, and distributing Kong images became critical. The team also faced growing demands from internal customers for hardened, customizable Kong and Kong Ingress Controller (KIC) images, as well as improved onboarding, documentation, and support for various deployment environments (Azure, AWS, EKS, Anthos, and hybrid setups). 

  To address these challenges, the LSEG Kong SME team developed a fully automated CI/CD pipeline using GitLab to build and publish customized Kong Distributed Images (KDI) and Kong Ingress Controller images. The team began by downloading enterprise Kong images from Kong HQ and layered them with hardened base OS images (primarily Debian). Vulnerability scanning was integrated using Black Duck to ensure secure image delivery. Each image was tested in a local dev environment to ensure it was production-ready before release. Images were then published to LSEG’s internal JFrog Artifactory repository and notifications were sent out to internal consumers alerting them to the new versions. A self-service portal—KDI Portal—was launched to serve as a central resource hub, offering onboarding instructions, plugin deployment patterns (such as Helm chart configurations), usage guides, and best practices. Customers could further tailor their deployments by overriding Dockerfiles or adding their own plugins, with the SME team available for support as needed. The process also accommodated new customer onboarding and version migrations, with continued support offered across environments. LSEG’s team expanded their automation journey by testing and validating Kong Konnect, enabling SSO integration and dev portal access for select internal use cases. By early 2024, additional enhancements were underway to refine Konnect and developer portal capabilities. To track performance and adoption, the team encouraged all users to integrate with Datadog for detailed usage metrics. 


  Since the launch of the automated pipeline in 2022, LSEG has dramatically improved the speed, security, and consistency of Kong image delivery. Highlights include: Accelerated Delivery:  Internal customers now receive hardened, validated Kong images automatically, reducing manual effort and deployment time. Standardized Onboarding:  A self-service portal and onboarding process has streamlined adoption across new internal teams. Improved Security:  Vulnerability scanning and image validation have increased confidence in the production readiness of Kong images. Wider Adoption:  Multiple internal customers across Azure, AWS EKS, and Anthos now rely on the Kong SME team’s automation pipeline, with several new customers onboarded in 2024. Innovation in Progress:  Ongoing enhancements to Kong Konnect and Dev Portal functionality are underway, expanding the potential for centralized management and observability. Through its investment in Kong automation, LSEG has established a scalable, secure, and flexible foundation for API management across its enterprise, supporting diverse use cases and cloud environments with confidence. 








LSEG

SivaSanka Muthusamy

 “We completed the automation of the Kong distributed images... and we are hardening them completely based on the recommendations from Kong.”

LSEG's Automated Pipeline for Secure Kong API Gateway Images

 Ubisoft, the global video game company behind franchises like Assassin’s Creed, Rainbow Six, and Far Cry, operates an internal developer platform designed to support teams building and deploying managed services across the organization. To ensure consistency and a unified developer experience, Ubisoft uses Kong as its API gateway and requires each service to expose a REST API based on the OpenAPI specification. With services developed by many different teams, the company established a dedicated Gateway Admin team to write and manage gateway configurations manually. These configurations were based on the OpenAPI documents provided by developers, enabling a consistent user experience and unified API hostname structure. 
  While this setup initially worked, it quickly proved difficult to scale. Managing configurations manually introduced human error, delayed onboarding for new services, and made enforcing security and policy standards challenging. Each service team had its own naming conventions, authentication methods, and path structures, making it difficult for the Gateway Admin team to maintain consistency. The lack of automation also led to slow propagation of changes across environments, inefficient collaboration between teams, and a heavy reliance on institutional knowledge to maintain the configuration. As the number of services grew, Ubisoft needed a scalable, self-service solution that could enforce global policies and security while reducing manual effort and minimizing mistakes. 
  To address these issues, Ubisoft built a custom Kubernetes operator that serves as a control plane layered on top of their existing control plane. This operator automatically ingests OpenAPI documents, applies standardized rules—like path prefix rewriting—and generates Kong configuration in a way that aligns with company-wide security and policy requirements. Service developers now provide their OpenAPI specifications either through a config map or via a URL. The Kubernetes operator parses the documents, applies business logic (like rewriting routes and enforcing authentication), merges them with Gateway Admin-defined policies, and pushes the resulting configuration to Kong. Crucially, policies defined by the Gateway Admins always take precedence, ensuring that enforced configurations cannot be overridden by service teams. Because the operator is built using Kubernetes-native tools and Golang libraries like decK, it enables self-healing, validation, and automated configuration drift detection. It also allows Ubisoft to support new API specification formats like OpenAPI v3 and protobuf, expanding the flexibility and future-proofing of their platform. 
  With the new operator-based system in place, Ubisoft significantly reduced the operational burden on the Gateway Admin team while improving the developer experience. Service teams can now onboard themselves with minimal support, thanks to self-service configuration and plugin management. The company enforces consistent security and path conventions across services without sacrificing flexibility or control. By owning their configuration generation logic, Ubisoft can easily adapt to evolving use cases, integrate services using different protocol formats, and ensure robust auditing and observability. The team now manages configuration through a desired-state model, leveraging Kubernetes’ reconciliation loop to maintain accuracy and reliability at scale. Ubisoft's custom Kubernetes operator turned a complex, error-prone manual process into an automated, scalable, and secure system that supports the company’s internal developer platform and their broader mission to ship games and services efficiently. 


Ubisoft

Ubisoft's Custom Kubernetes Operator for Managing Kong Services

 SeatGeek is a leading online ticketing platform that serves a wide range of customers including fans, brokers, and rights holders across the live entertainment industry. As the company continues to grow and expand its business partnerships, maintaining the performance and reliability of its backend services has become a top priority. Josh Woodward, Senior Platform Engineer at SeatGeek, has been spearheading efforts to strengthen platform resilience. With Kong Gateway at the center of their API management infrastructure, Josh’s team sought to address a persistent issue tied to broker-integrated services: unpredictable traffic surges that threatened system stability.  SeatGeek provides brokers with a data service for ticket listings, and many partners consume this service using high-frequency, automated systems. Even when these partners have good intentions, their traffic could create massive spikes that overwhelm backend services. This “noisy neighbor” issue risked degrading the platform’s overall performance, not just for the partner causing the spike but for others as well. SeatGeek needed a rate limiting strategy that could protect backend services from such overloads while accommodating the unique needs of thousands of integration partners. At the same time, the solution needed to support granular control, allow exceptions for high-priority partners, and integrate cleanly with SeatGeek’s Kubernetes-native infrastructure.  SeatGeek implemented Kong Gateway with the Rate Limiting Advanced plugin, deploying it via Kong Ingress Controller (KIC) within Kubernetes. This setup allowed the team to enforce default request limits—such as one request per second—while still offering flexibility to grant higher limits to specific partners. Rather than rely on IP addresses or headers to identify callers, the team defined known partners as Kong Consumers, each with key-based credentials. This approach gave them better traceability and control over traffic sources. To manage the scale of thousands of partners, SeatGeek built a custom controller—a Kubernetes pod that continuously syncs external data sources with the Kubernetes state. This eliminated the need to manually update manifests or store sensitive tokens in plain text. The team also used this system to associate traffic with the correct Kong Consumer, enabling consistent rate limiting enforcement. Before rolling out configuration changes, the team tested their setup in staging environments using load testing tools. This helped them validate the behavior of rate limiting policies and catch unintended issues before they affected production systems. For new services, SeatGeek implemented low default rate limits from the start, allowing budgets to grow over time. For existing services, they began by profiling traffic patterns and applying guardrails gradually to avoid disrupting long-standing integrations. 
  This new approach significantly improved platform stability by flattening traffic spikes and reducing the load on backend services. The team no longer had to scale infrastructure just to accommodate unpredictable surges. Trusted partners who needed higher throughput could be granted custom rate limits without compromising the experience for other users. The custom controller allowed SeatGeek to manage thousands of consumers automatically, reducing operational overhead while maintaining accuracy and security. Testing configurations before rollout prevented service disruptions, and the use of Kubernetes manifests enabled developers to manage their own rate limiting policies safely and autonomously. Josh emphasized that rate limiting at the gateway layer brought major benefits. It offered centralized control without burdening application code, aligned with platform engineering best practices, and empowered application teams to manage their own traffic policies. 
   Thanks to Kong Gateway and a thoughtfully designed Kubernetes integration, SeatGeek now delivers a more reliable and scalable API experience for its partners, without sacrificing agility or customer trust.

SeatGeek

Josh Woodward

 “Rate limiting in the gateway layer is a really nice win. It’s centralized, Kubernetes-native, and not an application concern—but still gives teams the autonomy they need.”

How to Protect APIs with Consumer-Based Rate Limiting with SeatGeek

While others catch up, you could be leading. Discover how Kong's platform can accelerate your digital transformation and drive innovation at scale.

Logo Kong Konnect Light

Platform

Solutions

Resources

Company

logo-wayfair

logo-wayfair-mono

Wayfair

Increase developer productivity, security, and performance at scale with the unified platform for API management, service mesh, and ingress controller

More Customer Stories

Get ahead today