The guarantees
What we promise. What we prove.
Zero data retention, named-region residency, and a bounded set of contract-bound upstream providers are hard routing constraints, not preferences. If no compliant endpoint exists for a request, the system fails closed with a no_compliant_provider response — it never downgrades silently.
Zero data retention
No storage after the request completes.
Prompts and outputs are not committed to persistent storage after the request. In-memory processing, automated in-memory safety review, and disclosed carve-outs such as lawful holds are not retention and are always disclosed.
AWS Bedrock, in-region
Served with data_retention_mode=none and enforced by account-level policy. Direct model IDs and provisioned throughput only — never Geo or Global profiles for a named-region promise.
Azure AI Foundry, regional
Standard regional provisioning with modified abuse monitoring — approval-gated. Endpoints are not ZDR-eligible until the approval is documented in the guarantee record.
Contractual ZDR and our own fleet
EU and US vendors with contractual ZDR terms, and self-hosted GPU capacity where ZDR is ours by construction. Every mechanism is recorded per endpoint.
Named-region residency
The region in your contract is the region of execution.
A gateway instance runs inside each promised region. Customer content is processed in the region of execution and never transits another region or Switzerland. Only non-content metadata crosses regional boundaries. Custom-region candidates are evaluated under a feasibility review and require a sales handoff before any commitment.
Contractual commitment
The contract is the product.
The DPA, SLA and sub-processor schedule turn the guarantees into legally flow-downable commitments. Every client commitment is backed by an upstream commitment we actually hold.
- General written sub-processor authorization with 30-day notice and objection
- Processor chain: you are the controller, we are the processor, the upstream is the sub-processor
- Breach of ZDR or residency is a contract event with passed-through remedies
Disclosed carve-outs
Exceptions are disclosed, never hidden.
Carve-outs are recorded per endpoint in the guarantee record and surfaced to clients. Routing never hides them.
CSAM / legal holds
Carve-out: CSAM/legal-hold and other lawful requests may require limited retention on specific endpoints. The carve-out is recorded per endpoint in the guarantee record and disclosed to clients — never silent.
Automated in-memory review
Foundry operates modified abuse monitoring as an in-memory review — disclosed, not retention.
Provider carve-outs
Vendor-specific exceptions are recorded per endpoint and reflected in the client terms and DPA wording.
Configurable retention
For sectors that must retain.
SEC/FINRA record-keeping and legal holds require retention. Where the law demands it, configurable retention is an opt-in, disclosed election recorded per organization — never a silent downgrade of the ZDR default.
Terminology
Legal-loaded terms, defined once.
These terms carry contractual meaning and are used consistently across marketing, console and documentation. Definitions are reviewed by legal counsel before launch.
DPA (Data Processing Agreement)
The written agreement that governs how the Service processes customer data on behalf of the customer, including the role of the provider as processor, sub-processor transparency, and the data-protection commitments that flow down to the customer.
ZDR (Zero Data Retention)
A processing mode in which prompts and outputs are not committed to persistent storage after the request completes. In-memory processing and disclosed carve-outs such as lawful holds or automated in-memory review are not retention.
Data residency (named region)
A contractual commitment that customer data is processed only in the named region, with regional execution enforced by the operating topology and verifiable per request.
Carve-outs
Disclosed exceptions to the standard data-handling commitment. Carve-outs are recorded per endpoint in the guarantee record and surfaced to customers; they are never hidden by routing.
SLA (Service-Level Agreement)
The availability and throughput commitment measured per calendar month, with service credits payable if the target is missed. Targets never exceed the upstream commitment they are derived from.
Localized definitions are hand-authored and pending legal review. In case of conflict, the English version of the contract documents governs.