The data stays in country, and you can prove it
The first question about LLM use in a public institution is not model quality but where the data is processed. The second is how that will be proven. Modelion settles both at the policy level: foreign candidates are closed off, and the region that processed each request is on record.
- All traffic hard-pinned to a single region
- Foreign candidates are never even evaluated
- Citizen data is never written to the cache
tr-west-1one region, hard-pinned with no fallback
What is hard in this sector
In the public sector the obstacle is usually not technical but evidential. Saying a service uses an LLM is easy; showing that the data never left the region, which decision rested on which rule, and that this held continuously, is hard.
What is hard in this sector
- The residency commitment is in the contract but not technically enforced.
- During an outage, the fallback mechanism can move traffic outside the committed region.
- Requests containing citizen data are written to the cache and can be returned to another request.
- Procurement and audit processes want a record of which provider saw which data.
- There is a preference for local or in-house models, but no way to verify traffic actually goes there.
The first three rules you'd write
These are not illustrative examples; they are the rules we discuss in the first session in this sector. Each is authored as YAML in the console, measured in shadow mode, then enforced.
- 1
residency-hard-pin- When
- every request
- Then
- permit only models in the local region · remove foreign candidates from the candidate list · disable fallback
Why it is shaped this wayWritten at the platform-baseline layer, no rule beneath it can loosen this — constraints intersect, they do not union. So a team cannot add a foreign model to its own rule set; even if it is in the combo, it will not run. - 2
citizen-data-cache-off- When
- signals.pii.detected OR request.headers.dataClass = citizen
- Then
- switch the semantic cache off · mask · write an audit tag
Why it is shaped this wayA semantic cache returns the same answer to similar prompts. On a request containing citizen data that is the risk of one person's answer being served to another query.lookup_onlyis not enough either; writes must be fully off. - 3
in-house-model-first- When
- every request
- Then
- candidate order: in-house vLLM → model hosted in the local region · no other candidates
Why it is shaped this wayPreferring the in-house model and proving traffic goes there are different things. Once policy sets the candidate chain, the decision trace shows which candidate ran, per request, and why.
What you show in an audit
- Residency report
- The regional distribution of requests over the period; zero out-of-region
- Rejected candidates
- Which rule removed the foreign candidate from the candidate list
- Provider record
- Which request went to which provider; the share served by the in-house model
- Cache evidence
- That requests containing citizen data were never written to the cache
- Rule history
- Which rule set was in force from which date
- Outage behaviour
- That with no candidate left the request was refused, not moved out of region
Questions from this sector
While a residency rule is in force and no candidate remains inside the region, the gateway returns 503. That is deliberate: failing open must never widen the compliance boundary. An outage is expensive, but regulated data in the wrong jurisdiction is more expensive. Defining several candidates inside the region is the right way to reduce that risk.
Yes. Registering your own vLLM cluster as a catalog provider is a standard setup step, available from the Team plan onwards. You can place it first in the candidate chain and use policy to close off falling through to anything else.
On-prem licensing is open for discussion on enterprise plans. It also means provider credential management moves to you — you take back part of the burden the hosted model removes. Which shape suits you is something we cover in the first session.
Decision traces are held in a queryable analytical store; regional distribution, per-rule decision counts and rejected candidates can be extracted as a periodic report. On enterprise plans retention is set contractually.
The regulatory references on this page exist to explain which product behaviour they drive; they are not legal advice. The scope of your own compliance obligations is something to establish with your legal team.
Let's start with your own rule set
The first session covers your traffic and your regulatory boundaries; you leave with a divergence report measured in shadow mode and three rules ready to write.