Providers, clouds, runtimes, frameworks, SIEM, identity
Keep your SDK. Change one URL.
YTT Secunet sits between your code and the providers you already use. Each integration guide covers the provider's regional deployments, setup steps, a working config and the policy notes your DPO will ask about.
diff / client.py
- base_url="https://api.openai.com/v1"
+ base_url="https://eu.yttsecunet.com/v1"
+ default_headers={
+ "X-YTT-Policy": "eu-gdpr-strict",
+ "X-YTT-Tenant": tenant.id,
+ }
- 15
- integration guides with regions, setup steps, config and policy notes
- YTT Secunet integration catalogue
- 10
- model providers and sovereign clouds with documented regional deployments
- YTT Secunet integration catalogue
- 2
- self-hosted runtimes that register as private endpoints in your VPC or data centre
- YTT Secunet integration catalogue
- 6 zones
- covered by at least one integration: EU, UK, CH, GCC, APAC, US
- YTT Secunet integration catalogue
Model provider
6OpenAIModel providerRoute GPT traffic through YTT Secunet to OpenAI's regional API hosts, so a European tenant only ever reaches an OpenAI project configured for European data residency.EUUKGCCUS
AnthropicModel providerReach Claude models through YTT Secunet on the deployment that matches each tenant's jurisdiction: Anthropic's own API for US-only inference, or Claude on Amazon Bedrock and Google Cloud Vertex AI in European regions.EUUKUS
Azure OpenAIModel providerUse YTT Secunet to keep every call on an Azure OpenAI deployment whose deployment type and region match the tenant's jurisdiction, and to block Global deployments for regulated traffic.EUUKCH
Amazon BedrockModel providerRoute to Amazon Bedrock in-Region endpoints and EU geography inference profiles with your own AWS credentials, while YTT Secunet blocks global profiles and records the exact Region in a signed receipt.EUUKCH
Google Cloud Vertex AIModel providerSend Gemini and partner models on Vertex AI to regional European endpoints through YTT Secunet, and keep the global endpoint out of reach for tenants that need in-region processing.EUUKCH
Mistral AIModel providerConnect Mistral's La Plateforme API and self-deployed Mistral open-weight models to YTT Secunet, giving European tenants an EU-headquartered model provider with policy enforcement and signed receipts.EUCHUS
Sovereign cloud
4ScalewaySovereign cloudRoute to Scaleway Generative APIs and Managed Inference in the Paris region through YTT Secunet, for French-hosted open-weight models behind an OpenAI-compatible interface.EU
OVHcloudSovereign cloudUse OVHcloud AI Endpoints, served from Gravelines in France, as an EU-headquartered inference target behind YTT Secunet's policy engine and receipts.EU
STACKITSovereign cloudRoute German-hosted inference to STACKIT AI Model Serving in region eu01, the Schwarz Group cloud, with YTT Secunet policy enforcement and per-request residency receipts.EU
SwisscomSovereign cloudKeep Swiss tenants' inference in Switzerland by routing to Swisscom's Swiss AI Platform managed inference endpoints, with YTT Secunet enforcing swiss-fadp-compliant policy and signing receipts.CH
Self-hosted runtime
2vLLMSelf-hosted runtimeRegister vLLM servers in your own VPC or data centre as YTT Secunet endpoints, so open-weight models serve as in-jurisdiction primaries or as the last-resort fallback that never leaves your network.EUUKCHGCC
OllamaSelf-hosted runtimeUse Ollama for local and edge inference behind YTT Secunet, so developer laptops, branch servers and test environments follow the same residency policy and receipt format as production.EUAPAC
Developer framework
1
Security & SIEM
1
Identity
1
Regional entry points follow the zone: eu, uk, ch, gcc, apac and us. Send each tenant's traffic to its own zone and the request never transits another region on the way in.
The model name becomes a logical alias. The registry maps it to a concrete deployment the pack allows, so the same code reaches Scaleway in Paris for a French tenant and Azure OpenAI in Frankfurt for a German one, and a provider change is a registry edit rather than a release.
Provider keys stay in YTT Secunet's secret vault or your KMS. Your application holds one YTT Secunet key per environment, and rotating a provider key does not touch application config.
import OpenAI from "openai";
// Before: straight to the provider, region decided by whoever
// created the API project.
// const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
// After: through the EU data plane. The policy decides the endpoint.
const client = new OpenAI({
baseURL: "https://eu.yttsecunet.com/v1",
apiKey: process.env.YTT_SECUNET_API_KEY,
defaultHeaders: {
"X-YTT-Policy": "eu-gdpr-strict",
"X-YTT-Tenant": tenant.id,
},
});
const { data, response } = await client.chat.completions
.create({ model: "claims-llm", messages })
.withResponse();
const receipt = response.headers.get("x-ytt-proof-signature");- 01
Register credentials
Store the provider key or cloud role in the YTT Secunet secret vault or your own KMS. Keys never appear in application code.
- 02
Admit the endpoint
The deployment goes into the registry with its region id, facility code, retention terms and certificate pin.
- 03
Attach a policy pack
Name the packs allowed to use it, for example eu-gdpr-strict or us-hipaa-only. Other packs can never select it.
- 04
Swap the base URL
Point your SDK at the regional YTT Secunet URL and send X-YTT-Policy and X-YTT-Tenant.
- 05
Verify a receipt
Send one request and check its X-YTT-Proof-Signature offline before moving production traffic.
Not listed? Anything that exposes an OpenAI-compatible or Anthropic-compatible API, including your own inference servers, can be registered as a private endpoint and goes through the same five steps.
Do I need a different SDK to use YTT Secunet?
No. The gateway speaks the OpenAI and Anthropic wire formats, so the official SDKs, LangChain and most agent frameworks work after a base URL change and two headers. Streaming, tool calls and JSON mode pass through.
Whose provider account is used?
Yours. You register your own provider keys or cloud credentials, and usage is billed by the provider to you as before. YTT Secunet charges for routed requests, not for tokens.
Can I connect a provider that is not listed?
Any endpoint that exposes an OpenAI-compatible or Anthropic-compatible API can be registered as a private endpoint on Enterprise Sovereign, and goes through the same region and certificate checks as listed providers.
Does an integration mean the provider endorses YTT Secunet?
No. Integrations describe how YTT Secunet connects to a provider's documented APIs and regional deployments. They are not partnerships or certifications by the provider unless a page says so explicitly.
What do the SIEM and identity integrations do?
SIEM integrations stream decision logs and receipt metadata, never prompt content, to your security tooling. Identity integrations connect SAML SSO and SCIM provisioning for console users and audit roles on Enterprise Sovereign.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.