US zone / us-itar-fedramp
US-only AI inference for FedRAMP, ITAR and HIPAA workloads
US-only routing to authorized government regions and BAA-covered endpoints, with signed proof of where every request ran.
Route card / US
base_url https://us.yttsecunet.com/v1
X-YTT-Policy us-itar-fedramp
endpoints 4 certified, 3 providers
primary AWS GovCloud (US-West)
failover Another authorized government endpoint
never A commercial region
plans Growth, Enterprise, Dedicated
| Instrument | Citation | What it means for an inference call |
|---|---|---|
| HIPAA Privacy and Security Rules | 45 CFR Parts 160 and 164 | Protected health information may be processed by a business associate only under a business associate agreement. HIPAA has no data localisation rule, but many covered entities require US-only processing by contract. |
| International Traffic in Arms Regulations | 22 CFR Parts 120 to 130; 22 CFR 120.54(a)(5) | Technical data on the US Munitions List cannot be exported or released to foreign persons without authorization. Sending ITAR technical data to an endpoint outside the US, or to one operated by foreign persons, can be an export. The end-to-end encryption carve-out in 120.54(a)(5) has strict conditions. |
| FedRAMP Authorization Act | FY2023 National Defense Authorization Act, codified at 44 U.S.C. 3607 to 3616 | Puts FedRAMP into statute. Federal agencies use cloud services with a FedRAMP authorization at the impact level matching their data (Low, Moderate or High). |
| DFARS safeguarding clause | DFARS 252.204-7012 | Defense contractors handling covered defense information must apply NIST SP 800-171 and use cloud services that meet FedRAMP Moderate equivalent requirements. |
| DOJ Data Security Program | 28 CFR Part 202, effective 8 April 2025 | Restricts certain transactions that give countries of concern or covered persons access to bulk US sensitive personal data and government-related data. Relevant when choosing model vendors and subprocessors. |
Why the US zone is about boundaries, not geography alone
For most US workloads, routing to a US region is enough. For federal, defense and health workloads it is not. FedRAMP authorizes specific services in specific environments, ITAR restricts who can access technical data as well as where it goes, and HIPAA requires a business associate agreement with every party that touches protected health information. A prompt to a commercial region of a provider that is not authorized at the right impact level, or that is operated by foreign persons, can be a compliance failure even though the server is in Virginia.
The us-itar-fedramp pack expresses those boundaries as endpoint attributes: authorization level, environment (commercial or government), operator citizenship controls and BAA coverage. A request labelled ITAR can only reach endpoints in a government environment with US-person operations; a request labelled PHI can only reach endpoints under a signed BAA; anything else follows the tenant's general US policy.
GovCloud and Azure Government endpoints
Both AWS GovCloud (US) and Azure Government are physically and logically separate US environments, operated by screened US persons, with FedRAMP High authorizations. Amazon Bedrock is offered in GovCloud (US-West) and Azure OpenAI is offered in Azure Government. Model availability in these environments trails the commercial regions, and the registry tracks which model versions are authorized there today. When a model is not available in the government environment, the policy refuses the call instead of falling back to a commercial region.
For health workloads that do not need government environments, commercial US regions of providers that sign a BAA are usually the right target. The us-hipaa-only pack checks for a BAA reference on the endpoint record and keeps PHI on US endpoints with zero data retention.
ITAR, foreign persons and how YTT Secunet is deployed
ITAR raises a question about YTT Secunet itself. YTT SECUNET PRIVATE LIMITED is an Indian company with its engineering team in Chennai, so giving our staff access to ITAR technical data would be an export to foreign persons. For that reason, ITAR workloads run only on Sovereign Dedicated, deployed in the customer's GovCloud account, Azure Government subscription or on-prem enclave, operated by the customer's US-person staff, with customer-held signing keys in the customer's HSM. YTT Secunet personnel have no access to traffic, logs or keys, and support runs on metadata the customer chooses to share.
- Air-gapped deployment with offline licensing for classified-adjacent enclaves.
- Receipts signed with the customer's own Ed25519 key, verifiable offline with ytt-verify.
- No telemetry leaves the enclave unless the customer exports it.
Evidence for ATO packages and HIPAA risk analysis
Agencies and contractors building an authority to operate need to show boundary controls and audit records. The YTT Secunet receipt stream gives an auditable record of every model call: endpoint, environment, model id, policy version and timestamp, anchored in an hourly Merkle root. For HIPAA, the same records support the risk analysis required by 45 CFR 164.308(a)(1) by showing which systems processed PHI and under which agreement.
Where our responsibility stops
YTT Secunet enforces where inference runs and signs a receipt for it. It does not give legal advice and does not replace your DPIA or transfer impact assessment.
Each entry is a specific deployment, not a provider as a whole. The registry pins region and deployment type, and refuses a route to a model the region does not serve instead of falling back to another zone.
Amazon Bedrock
AWS GovCloud (US-West)
FedRAMP High environment operated by US persons; for ITAR and federal workloads.
Microsoft Azure OpenAI
Azure Government, US
Separate government cloud; model list narrower than commercial Azure.
Amazon Bedrock
us-east-1, Northern Virginia
HIPAA-eligible service under an AWS BAA; for PHI that does not need a government environment.
vLLM on customer infrastructure
Customer enclave, United States
Open-weight models in air-gapped or on-prem environments.
This is the rule set the gateway evaluates for United States: FedRAMP, ITAR and HIPAA traffic. Your application names it in the X-YTT-Policy header, pinned to a version, and the decision is made before the request is forwarded to any provider.
- Evaluated by Open Policy Agent in the regional data plane, under 3 ms median (YTT Secunet production telemetry)
- Pack id and version are written into every signed receipt, so an auditor can match traffic to the rule that allowed it
- A denial returns HTTP 451 with the decision id and reason; there is no silent reroute
- Legal teams review changes in the visual policy editor before engineering merges them
package yttsecunet.us_itar_fedramp
default allow := false
# ITAR technical data: government environment, US-person operations.
allow if {
input.classification.label == "itar"
input.endpoint.country == "US"
input.endpoint.environment == "government"
input.endpoint.us_person_operations == true
input.endpoint.fedramp_level == "high"
}
# PHI: US endpoint under a signed BAA, zero data retention.
allow if {
input.classification.label == "phi"
input.endpoint.country == "US"
input.endpoint.baa_reference != ""
input.endpoint.zdr == true
}
# Other federal data: FedRAMP level must meet the data's impact level.
levels := {"low": 1, "moderate": 2, "high": 3}
allow if {
input.classification.label == "federal"
levels[input.endpoint.fedramp_level] >= levels[input.classification.impact_level]
}
deny contains "ITAR data outside a US government environment" if {
input.classification.label == "itar"
input.endpoint.environment != "government"
}Government endpoints fail over only to another authorized government endpoint or the customer's US enclave, never to a commercial region. Resilience comes from a second facility or provider inside the zone. If none is healthy the gateway refuses the request rather than sending it to the nearest region across the border.
- Client app, tenant domicile US, calls us.yttsecunet.com
- Primary: AWS GovCloud (US-West)
- In-zone failover: Another authorized government endpoint
- Never: A commercial region. With no healthy in-zone endpoint the gateway fails closed with HTTP 503.
Is YTT Secunet FedRAMP authorized?
No. YTT Secunet does not hold a FedRAMP authorization. Federal and ITAR workloads run on Sovereign Dedicated inside the customer's own authorized environment, so the authorization boundary is the customer's GovCloud, Azure Government or on-prem system.
Does HIPAA require US-only processing?
HIPAA itself does not require data localisation; it requires a business associate agreement and the Security Rule safeguards. Many covered entities and their contracts require US-only processing, which the us-hipaa-only pack enforces.
Can YTT Secunet staff see ITAR traffic?
Not in the supported deployment. ITAR workloads use Sovereign Dedicated, operated by the customer's US-person staff, with customer-held keys. YTT Secunet engineers, many of whom are foreign persons, have no access.
Will a missing model in GovCloud break our application?
The policy refuses the call with a clear reason rather than sending it to a commercial region. Most teams configure an in-boundary fallback, such as a different authorized model or a self-hosted open-weight model.
Sovereign route ready
Route US inference inside the US zone, with proof.
Change the base URL, name the policy pack, and every response carries a signed residency receipt your DPO can verify offline.