EU zone / eu-gdpr-strict
GDPR Chapter V and EU AI Act sovereign compliance for AI inference
Route every European prompt to an EEA endpoint, enforce Chapter V as code, and prove where inference ran with a signed receipt.
Route card / EU
base_url https://eu.yttsecunet.com/v1
X-YTT-Policy eu-gdpr-strict
endpoints 6 certified, 5 providers
primary Frankfurt
failover Amsterdam or Paris
never Virginia
plans Growth, Enterprise, Dedicated
| Instrument | Citation | What it means for an inference call |
|---|---|---|
| General Data Protection Regulation, Chapter V | Regulation (EU) 2016/679, Articles 44 to 49 | Any transfer of personal data to a third country needs an adequacy decision (Art. 45), appropriate safeguards such as SCCs (Art. 46) or a narrow derogation (Art. 49). A prompt sent to a US endpoint is a transfer. Breaches fall under the Art. 83(5)(c) ceiling of EUR 20 million or 4% of worldwide annual turnover. |
| Standard Contractual Clauses | Commission Implementing Decision (EU) 2021/914 of 4 June 2021 | The modular SCCs used for controller-to-processor and processor-to-processor transfers. After Schrems II they must be paired with a transfer impact assessment and, where needed, supplementary measures. |
| EU-US Data Privacy Framework adequacy decision | Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 | Covers transfers only to US organisations self-certified on the DPF List. It does not cover providers that are not listed, and it remains open to future challenge before the CJEU. |
| EU Artificial Intelligence Act | Regulation (EU) 2024/1689, Articles 10, 50 and Annex IV | In force since 1 August 2024. Art. 10 sets data governance duties for high-risk systems; Art. 50 sets transparency duties for systems that interact with people or generate content. Annex III high-risk obligations apply from 2 December 2027 after the AI omnibus amendment, Regulation (EU) 2026/1744. |
| Digital Operational Resilience Act | Regulation (EU) 2022/2554 | Applies to financial entities from 17 January 2025. AI model providers and gateways used for critical functions belong in the register of information on ICT third-party service providers. |
The Schrems II dilemma for AI inference
On 16 July 2020 the Court of Justice decided Case C-311/18 and struck down the Privacy Shield. The Court kept standard contractual clauses alive, but only where the exporter verifies that the law of the destination country does not undermine them. If it does, the exporter must add supplementary measures or stop the transfer. EDPB Recommendations 01/2020 then set out what those measures can look like, and the hard case they describe is the one AI teams now live in: a provider that needs the data in clear text to process it.
That is exactly what an LLM call is. Encryption in transit protects the wire, but the model has to read the prompt to answer it. A clause in a contract cannot stop a US provider from receiving a lawful order under FISA Section 702 for data it holds or processes, which is why the Irish DPC fined Meta Platforms Ireland EUR 1.2 billion on 22 May 2023 for SCC transfers to the US. The DPF adequacy decision of 10 July 2023 eased the position for certified recipients, but many security teams and works councils still ask for the simpler answer: the prompt never left the EEA.
YTT Secunet gives that answer at the network layer. The eu-gdpr-strict pack refuses any endpoint whose provider region sits outside the EEA, removes the Art. 46 question for inference traffic by not making a transfer at all, and records the resolved endpoint and facility in a signed receipt. Where a team does want a US model for some workloads, the policy can allow it only for traffic the PII guardrail has pseudonymized, with the re-identification table kept in the EU vault.
EU AI Act Article 10 and Article 50, enforced in the request path
Article 10 requires providers of high-risk AI systems to run data governance and management practices covering collection, preparation, bias examination and the handling of personal data, including the narrow Art. 10(5) basis for processing special category data to detect and correct bias. Annex IV then asks for technical documentation that describes those practices. For an application built on a hosted model, much of the evidence a notified body or market surveillance authority will ask for is operational: which model version answered, under which policy, from which location.
Article 50 adds transparency duties: people must be told when they interact with an AI system, and synthetic content must be marked in a machine-readable way. YTT Secunet does not decide whether your system is high-risk, and it does not replace your conformity assessment. It enforces the parts that can be enforced per request and keeps the evidence.
- The eu-ai-act-high-risk pack blocks calls to model versions that are not on the system's approved list, so an unannounced model swap cannot reach production.
- Each receipt records the model id, policy pack id and version, which maps directly to Annex IV sections on system components and change logs.
- An Art. 50 flag can require a disclosure header on responses that your front end must render before the answer is shown.
- Compliance Reports export a quarterly Annex IV evidence bundle: endpoint inventory, policy change history and receipt Merkle roots.
Supported EU endpoints and how they are pinned
EU routing uses provider regions that are physically in the EEA and contracted under EU terms. For hyperscalers, the registry pins regional deployment types only: an Azure OpenAI Global deployment or an AWS Bedrock cross-region inference profile can process outside the region you named, so the policy engine rejects those configurations unless the profile's region list has been reviewed and stays inside the EEA.
For buyers who want to remove US-parented providers entirely, the registry includes EU-headquartered options: Mistral AI's la Plateforme, Scaleway Generative APIs in Paris and OVHcloud AI Endpoints in Gravelines, plus self-hosted vLLM clusters on STACKIT or in your own data centre. Failover stays inside the same legal zone. A Frankfurt outage moves traffic to Amsterdam or Paris, never to Virginia, and the receipt for the failover request names the facility that actually served it.
A DPA with SCCs you can sign this week
YTT Secunet signs an Article 28 data processing agreement as your processor. It lists our subprocessors by region, describes zero data retention for prompts and completions, and commits to the EU control plane in Frankfurt with Paris standby. Because YTT SECUNET PRIVATE LIMITED is established in India, which has no EU adequacy decision, the DPA incorporates Module 2 and Module 3 of the 2021 SCCs for any access by our support staff outside the EEA, and our transfer impact assessment is available in the Trust Center.
We say plainly what the DPA does not do. It does not make a US-parented model provider immune from the CLOUD Act, and it does not replace your own DPIA or TIA. What it does is shorten them: when the prompt is processed in the EEA with no retention and the receipt proves it, the transfer section of your assessment becomes a short one.
Where our responsibility stops
YTT Secunet enforces where inference runs and signs a receipt for it. It does not give legal advice and does not replace your DPIA or transfer impact assessment.
Each entry is a specific deployment, not a provider as a whole. The registry pins region and deployment type, and refuses a route to a model the region does not serve instead of falling back to another zone.
Microsoft Azure OpenAI
Germany West Central, Frankfurt
Regional Standard deployments only; Global deployment types are rejected by policy.
Microsoft Azure OpenAI
Sweden Central, Sweden
Broad model catalogue inside the EEA; common secondary for Frankfurt tenants.
Amazon Bedrock
eu-central-1, Frankfurt
In-region model IDs pinned; cross-region inference profiles reviewed before use.
Mistral AI
European Union
EU-headquartered provider; la Plateforme API with EU hosting.
Scaleway Generative APIs
fr-par, Paris
French provider, OpenAI-compatible API for open-weight models.
OVHcloud AI Endpoints
Gravelines, France
French provider, serverless access to open-weight models.
This is the rule set the gateway evaluates for European Union traffic. Your application names it in the X-YTT-Policy header, pinned to a version, and the decision is made before the request is forwarded to any provider.
- Evaluated by Open Policy Agent in the regional data plane, under 3 ms median (YTT Secunet production telemetry)
- Pack id and version are written into every signed receipt, so an auditor can match traffic to the rule that allowed it
- A denial returns HTTP 451 with the decision id and reason; there is no silent reroute
- Legal teams review changes in the visual policy editor before engineering merges them
package yttsecunet.eu_gdpr_strict
# Tenant domiciled in the EEA: inference must stay on EEA endpoints.
allowed_zones := {"EU", "EEA"}
default allow := false
allow if {
input.tenant.domicile == "EU"
input.endpoint.jurisdiction in allowed_zones
input.endpoint.deployment_type == "regional"
input.endpoint.zdr == true
not unmasked_special_category
}
unmasked_special_category if {
input.classification.special_category
not input.pii.masked
}
deny contains "endpoint outside the EEA" if {
not input.endpoint.jurisdiction in allowed_zones
}
deny contains "global or cross-region deployment type" if {
input.endpoint.deployment_type != "regional"
}
deny contains "endpoint does not offer zero data retention" if {
not input.endpoint.zdr
}Frankfurt to Amsterdam or Paris inside the EEA, never to Virginia. Resilience comes from a second facility or provider inside the zone. If none is healthy the gateway refuses the request rather than sending it to the nearest region across the border.
- Client app, tenant domicile EU, calls eu.yttsecunet.com
- Primary: Frankfurt
- In-zone failover: Amsterdam or Paris
- Never: Virginia. With no healthy in-zone endpoint the gateway fails closed with HTTP 503.
Does the EU-US Data Privacy Framework make this unnecessary?
The DPF covers transfers to certified US organisations, and it is a valid Art. 45 basis today. Many buyers still require EEA processing for AI workloads because the DPF may be challenged, because not every provider or subprocessor is certified, and because their own customers write EEA processing into contracts. YTT Secunet lets you choose either posture per tenant and proves which one applied.
Is a prompt to a US endpoint really a transfer if nothing is stored?
Yes. Chapter V is about making personal data available to a recipient in a third country, not about storage. A prompt containing a customer name that is processed in Virginia is a transfer even if the provider deletes it seconds later.
Can we still use OpenAI or Anthropic models for EU users?
Yes, through the providers' EU regional deployments where they exist, such as Azure OpenAI in Frankfurt or Sweden Central and Anthropic models on Amazon Bedrock in Frankfurt. The policy checks the deployment type so a global endpoint cannot slip in.
Does YTT Secunet replace our DPIA or TIA?
No. YTT Secunet enforces the technical controls and produces evidence. Your DPIA under Art. 35 and any transfer impact assessment remain your responsibility; the receipts and endpoint inventory make the factual sections much shorter to write.
Sovereign route ready
Route EU inference inside the EU zone, with proof.
Change the base URL, name the policy pack, and every response carries a signed residency receipt your DPO can verify offline.