Integration / Model provider
Azure OpenAI, routed by jurisdiction.
Use YTT Secunet to keep every call on an Azure OpenAI deployment whose deployment type and region match the tenant's jurisdiction, and to block Global deployments for regulated traffic.
In Azure OpenAI the residency guarantee is set by the deployment type, not only by the resource region. Microsoft documents three families. Global deployments may process prompts in any Azure region where the model is deployed. Data Zone deployments process only inside a Microsoft-defined data zone, currently the US or the EU, where the EU zone covers Azure regions in EU Data Boundary countries. Standard (regional) and regional provisioned deployments process in the resource's own region. In every case Microsoft states that data at rest is stored in the region of the resource. So a resource created in Sweden Central with a Global Standard deployment stores data in Sweden but can process a prompt elsewhere, a detail that routinely gets lost in security questionnaires.
YTT Secunet reads the deployment type as part of the endpoint record. An eu-gdpr-strict policy accepts Data Zone EU and regional deployments in EU regions and refuses Global deployments outright. A swiss-fadp-compliant policy can be narrowed further to a regional deployment in Switzerland North, and a uk-gdpr-idta policy to UK South. When a deployment returns 429 or 5xx, failover goes to another deployment that satisfies the same rule, for example from Germany West Central to a Data Zone EU deployment, never to a Global one.
Two documented limits belong in your assessment. Azure OpenAI sits inside Microsoft's EU Data Boundary when deployed in an EU region, but Microsoft's EU Data Boundary documentation lists continuing transfers, among them remote access by personnel outside the boundary, global security operations, and network transit that may occasionally route outside the boundary. And Microsoft retains prompts for abuse monitoring unless you are approved for modified abuse monitoring. YTT Secunet records the deployment type, region and your approved monitoring status in each signed receipt, which is the evidence auditors ask for.
| Region or deployment | Location | Jurisdiction |
|---|---|---|
| Sweden Central | Gävle, Sweden | EU / European Union |
| Germany West Central | Frankfurt am Main, Germany | EU / European Union |
| France Central | Paris, France | EU / European Union |
| Switzerland North | Zurich, Switzerland | CH / Switzerland |
| UK South | London, United Kingdom | UK / United Kingdom |
| Data Zone EU (deployment type) | Azure regions in EU Data Boundary countries | EU / European Union |
- 01
Create Azure OpenAI resources in the regions you need and deploy models with a Data Zone EU, Standard or regional provisioned deployment type. Avoid Global deployment types for regulated tenants.
- 02
Apply for modified abuse monitoring if your DPIA requires that prompts are not retained by Microsoft, and note the approval in the endpoint record.
- 03
Register each deployment in YTT Secunet with its resource endpoint, deployment name, deployment type and region; authenticate with a managed identity or a key held in your Key Vault.
- 04
Attach deployments to policy packs: Data Zone EU and EU regional deployments to eu-gdpr-strict, Switzerland North to swiss-fadp-compliant, UK South to uk-gdpr-idta.
- 05
Point the OpenAI SDK at your regional YTT Secunet base URL; YTT Secunet translates to the Azure deployment path and api-version for you.
endpoints:
- id: aoai-gwc-gpt41
provider: azure-openai
resource: https://contoso-gwc.openai.azure.com
deployment: gpt-41-dze
deployment_type: DataZoneStandard
data_zone: EU
region: germanywestcentral
auth: managed-identity
abuse_monitoring: modified
- id: aoai-chn-gpt41
provider: azure-openai
resource: https://contoso-chn.openai.azure.com
deployment: gpt-41-std
deployment_type: Standard
region: switzerlandnorth
auth: managed-identity
routes:
- policy: eu-gdpr-strict
allow_deployment_types: [DataZoneStandard, Standard, ProvisionedManaged]
deny_deployment_types: [GlobalStandard, GlobalBatch, GlobalProvisioned]
primary: aoai-gwc-gpt41
- policy: swiss-fadp-compliant
primary: aoai-chn-gpt41- Global deployment types are rejected by every residency pack, because Microsoft documents that they can process in any region where the model is deployed.
- Data Zone EU is accepted for EU packs but not for swiss-fadp-compliant when the policy requires processing in Switzerland, since the EU zone can process in any EU member state region.
- Model and deployment type availability varies by region; the endpoint registry checks the actual deployment before a route is activated.
- Receipts carry the Azure region id (for example germanywestcentral) and deployment type, so an operator who changes a deployment to Global is caught on the next request.
Is Azure OpenAI in an EU region enough on its own?
It covers storage at rest, and processing too if you pick a regional or Data Zone EU deployment type. It does not cover what your developers point their code at. YTT Secunet enforces that regulated tenants only reach compliant deployments and produces a receipt per call.
Can YTT Secunet use Data Zone EU for a Swiss bank?
Only if the bank's policy allows EU processing. Switzerland is in Microsoft's EU Data Boundary, but the Data Zone EU deployment type processes in EU member state regions. Most Swiss banking policies we see pin a regional deployment in Switzerland North instead.
Does YTT Secunet add latency on Azure?
YTT Secunet's own telemetry puts added p99 latency under 8 ms. With a YTT Secunet data plane in Frankfurt and a Germany West Central deployment, the request path stays in the metro area.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.