Any region. Any framework.
A declarative policy engine at the router edge — residency, provider eligibility, data-class handling, retention and audit — bound to org, project, key or a single request.
This page is maintained by llmcloud.ai to describe our security, privacy and compliance posture. It is not an independent certification. Where a capability is on the roadmap, we mark it clearly.
Region-pinned routing
Constrain every request to providers hosted in a specific region. EU-only, US-only, UK-only, India-only and more. Hard fail if no eligible peer is available — never silent leakage.
Provider allow-lists
Per-tenant registry of which upstream providers are contractually eligible. HIPAA BAA signed? Zero-retention terms? Data-processor role? Filter on any of it.
PII / PHI / PCI handling
Detect and redact, tokenize, or block sensitive classes at the edge. Round-trip synthetic placeholders so nothing sensitive touches an upstream.
Log residency & retention
Pin the log store to a region. Configure retention from 0s (zero-retention) to 7y (regulated verticals). Right-to-erasure workflows for GDPR / CCPA / DPDP.
Signed audit trail
Hash-chained records with actor, purpose_of_use, lawful_basis, policy_id, model, provider and region. Exportable to Splunk, Datadog, S3 or Azure Sentinel.
DPA / BAA / SCCs self-serve
Click-through DPA, HIPAA BAA (eligible plans), SCCs, UK IDTA, Swiss addendum, KSA and UAE addenda from the dashboard.
POST /v1/policies
{
"name": "eu-healthcare",
"residency": { "regions": ["eu-frankfurt","eu-ireland"] },
"providers": {
"require": ["hipaa_baa","zero_retention","gdpr_dpa"],
"deny": ["cn-*","us-gov-*"]
},
"data_classes": {
"pii": { "action": "redact" },
"phi": { "action": "tokenize" },
"pci": { "action": "block" }
},
"retention": { "logs_days": 30, "prompts": "none" },
"audit": { "sink": "customer-splunk", "hash_chain": true }
}# Bind to a key
PATCH /v1/keys/hospital-agent
{ "policy": "eu-healthcare" }
# Per-request override
POST /v1/chat/completions
Headers:
X-LLMCloud-Policy: eu-healthcare
X-LLMCloud-Purpose: clinical_summary
Body:
{ "model": "auto:quality", "messages": [...] }
# Response headers report enforcement
x-llmcloud-policy-id: pol_01H...
x-llmcloud-residency: eu-frankfurt
x-llmcloud-provider: anthropic-eu
x-llmcloud-guardrail: pii=redacted,phi=tokenizedWhich frameworks do you cover?+
GDPR + EU-US DPF, UK GDPR, Swiss FADP, CCPA/CPRA, PIPEDA + Quebec Law 25, LGPD, APPI, PDPA, DPDP, Privacy Act (AU), UAE PDPL, KSA PDPL, POPIA, plus AI-specific frameworks (EU AI Act, NIST AI RMF, ISO/IEC 42001) and verticals (HIPAA, PCI, FedRAMP, IRAP, DORA, CJIS). See the frameworks matrix.
Are you certified?+
Certification programs are in progress. See Certifications for current status and target dates. Contracts (DPA, BAA templates) and technical controls (residency, redaction, audit) are usable today.
Can we self-host in our own VPC?+
Yes. The open-source router runs the same policy engine locally — prompts and logs never leave your account. See Self-host.