Jurisdictions / six legal zones
Six legal zones. One gateway that never crosses them.
Every request resolves to a legal zone before the prompt leaves your network. Each zone has its own certified endpoints, its own Rego policy pack and a failover pair that stays inside the border.
Zone resolution / tenant domicile
tnt_de_4417DEEU eu.yttsecunet.com
tnt_gb_0291GBUK uk.yttsecunet.com
tnt_ch_0114CHCH ch.yttsecunet.com
tnt_sa_7702SAGCC gcc.yttsecunet.com
tnt_au_3305AUAPAC apac.yttsecunet.com
tnt_us_3318USUS us.yttsecunet.com
cross-zone failover DISABLED BY DESIGN
Zones follow legal regimes, not cloud regions. The orange marker is the primary site for a tenant domiciled in the zone, the green arc is the failover the policy permits, and the red line is the destination the gateway will not use, even when it is the closest healthy capacity.
EU zone / eu.yttsecunet.com
European Union
- Main law
- GDPR Chapter V; EU AI Act
- Transfer basis
- Adequacy (Art. 45) or SCCs with a TIA (Art. 46); EEA routing avoids the transfer
- Regulator
- EDPB and national DPAs; AI Office
- Failover
- Frankfurt to Amsterdam or Paris inside the EEA, never to Virginia.
- Plans
- Growth, Enterprise, Dedicated
Certified endpoints
- Microsoft Azure OpenAI, Germany West Central, Frankfurt
- Microsoft Azure OpenAI, Sweden Central, Sweden
- Amazon Bedrock, eu-central-1, Frankfurt
- Mistral AI, European Union
- Scaleway Generative APIs, fr-par, Paris
- OVHcloud AI Endpoints, Gravelines, France
| Zone | Main law | Transfer mechanism | Regulator | Policy pack | Failover pair | Plans |
|---|---|---|---|---|---|---|
| European Union | GDPR Chapter V; EU AI Act | Adequacy (Art. 45) or SCCs with a TIA (Art. 46); EEA routing avoids the transfer | EDPB and national DPAs; AI Office | eu-gdpr-strict | Frankfurt to Amsterdam or ParisNever: Virginia | Growth, Enterprise, Dedicated |
| United Kingdom | UK GDPR; Data Protection Act 2018 | UK adequacy regulations, IDTA or UK Addendum, UK Extension to the DPF | Information Commissioner's Office | uk-gdpr-idta | London to Second UK provider or UK clusterNever: Dublin, for UK-only tenants | Growth, Enterprise, Dedicated |
| Switzerland | revFADP (nDSG); Banking Act Art. 47 | Federal Council adequacy list (DPO Annex 1) or FDPIC-recognised SCCs | FDPIC; FINMA for banks | swiss-fadp-compliant | Zurich to Geneva or Swiss customer DCNever: Frankfurt, for Swiss-only tenants | Enterprise, Dedicated |
| Middle East (GCC) | Saudi PDPL; UAE PDPL | PDPL Art. 29 with the SDAIA Transfer Regulation; UAE PDPL Arts. 22 and 23 | SDAIA (NDMO) and NCA; UAE Data Office | saudi-pdpl-sovereign | Riyadh to Another in-Kingdom endpointNever: Dubai, for Saudi tenants | Enterprise, Dedicated |
| Asia-Pacific | Singapore PDPA s. 26; Australia APP 8 | Comparable-standard test (PDPA) and APP 8 accountability, decided per country | PDPC Singapore; OAIC Australia | apac-in-country | Sydney to Melbourne, in-country onlyNever: Singapore, for Australian tenants | Enterprise, Dedicated |
| United States: FedRAMP, ITAR and HIPAA | ITAR; FedRAMP; HIPAA | No foreign release of ITAR technical data; BAA for PHI; authorized boundaries only | DDTC; HHS OCR; FedRAMP PMO | us-itar-fedramp | AWS GovCloud (US-West) to Another authorized government endpointNever: A commercial region | Growth, Enterprise, Dedicated |
The zone is decided before the model sees a token.
The gateway reads the X-YTT-Tenant header and resolves the tenant's zone using one of three strategies you set per tenant. Most B2B products use tenant domicile, taken from the customer master record. Consumer products often use the end user's geo-IP and locale. Regulated workloads add data sensitivity, so a prompt the PII guardrail classifies as health data can be held to a narrower pool, such as HDS-certified hosting in France, than the rest of the tenant's traffic.
Once the zone is known, the policy pack named in X-YTT-Policy filters the endpoint registry to candidates that sit inside that zone, offer zero data retention and match the deployment type the pack requires. Global and cross-region deployment types are rejected unless the pack explicitly allows them. The router picks the healthiest candidate and the notary signs a receipt naming the facility that served the request.
Strategy 01
Tenant domicile
Customer master data says the tenant is a German GmbH: zone EU, pack eu-gdpr-strict.
Strategy 02
User geo-IP and locale
A consumer in Zurich with de-CH locale: zone CH, even inside an EU tenant, when policy says so.
Strategy 03
Data sensitivity
Identified health data: HDS pool only. Pseudonymized text: any EU endpoint the pack allows.
Crossing a zone is never automatic. If a workload needs a model that only exists in another zone, the tenant's policy has to list that route together with its transfer basis (an adequacy decision, SCCs with a TIA, an IDTA, or a pseudonymization requirement), and every receipt for that traffic records the basis that applied.
- EUR 20M or 4%
- of worldwide annual turnover, whichever is higher: GDPR Article 83(5) ceiling for unlawful international transfers
- Regulation (EU) 2016/679, Art. 83(5)(c)
- EUR 1.2B
- fine on Meta Platforms Ireland for transferring EU user data to the US under SCCs after Schrems II
- Irish Data Protection Commission, 22 May 2023
- 80 to 100 ms
- typical round trip between Frankfurt and US East (Northern Virginia) before any model compute
- Speed-of-light fibre path, public cloud inter-region latency measurements
- < 8 ms
- p99 added gateway latency, policy evaluation plus receipt minting
- YTT Secunet production telemetry, 2026
European Union
United Kingdom
Switzerland
Middle East (GCC)
Asia-Pacific
United States: FedRAMP, ITAR and HIPAA
Why is the United Kingdom a separate zone from the EU?
The UK has run its own transfer regime since the end of the Brexit transition period. UK adequacy regulations let a UK controller send data to the EEA, but many UK contracts in the NHS supply chain, central government and FCA-regulated firms require UK processing anyway. A separate zone lets a tenant be UK-only, or UK-or-EEA, with one line of policy.
Can one customer use several zones at once?
Yes. Each legal entity or customer tenant carries its own domicile and policy pack, so a group with booking centres in Zurich, London and Frankfurt can run one application against one gateway and have each request resolved to the zone its entity belongs to.
What happens when a zone has no healthy endpoint?
The gateway fails closed. It returns HTTP 503 with a signed denial receipt instead of sending the prompt to the nearest healthy region in another zone. Resilience comes from a second provider or a self-hosted cluster inside the same zone.
Is Asia-Pacific a single legal zone?
No. Singapore, Australia, India and Japan each have their own transfer rules, so the APAC zone routes at country level. A Sydney tenant stays in Australia and a Singapore tenant stays in Singapore unless the tenant's policy lists a cross-border route and its transfer basis.
Do zones replace a transfer impact assessment or a DPIA?
No. Zones enforce where inference runs and produce evidence of it. Your counsel still decides the lawful basis, writes the DPIA where Article 35 GDPR requires one, and assesses any transfer you choose to allow. YTT Secunet does not give legal advice.
Which plans include which zones?
Growth includes the EU, UK and US zones. Enterprise Sovereign adds Switzerland, the GCC and Asia-Pacific plus custom Rego. Sovereign Dedicated runs the gateway in your VPC or on-prem with an in-country control plane, for any zone.
Sovereign route ready
Pick a zone. Prove every request stayed in it.
Point your SDK at a regional entry point, add two headers, and get a signed residency receipt on every response.