Field notes / policy, cryptography, infrastructure
Rulings, engineering and enforcement
Written by the people who build the router: what a ruling means for an inference path, how a receipt proves where a prompt ran, and what the latest fine changes for AI teams.
LatestEngineering2 Nov 2026 / 4 min
A self-hosted vLLM fallback that keeps sovereign routes alive
An open-weight model on vLLM in your own data centre is the last resort when in-region providers fail. How to size it, lock it down and prove it works.
- A self-hosted runtime is the one endpoint whose country, operator, retention and network path you control completely, which makes it the natural last node in a failover graph.
- Do the memory arithmetic first: a 24 billion parameter model in BF16 needs about 48 GB for weights before any KV cache.
- MKMeera KrishnanHead of Policy Engineering4
- VDVikram DesaiCo-founder & CTO2
- RSRahul SethiHead of Cryptography2
- BSBaljit SinghCo-founder & CEO1
- KMKabir MalhotraVP Sovereign Infrastructure1
- DNDeepa NairHead of Security & Compliance1
- SKSanjay KulkarniVP Customer Engineering, EMEA1
Beats
Regulation and rulings, engineering of the data path, enforcement analysis, reference architectures, and AI governance for DPOs and platform teams.
- 12
- posts published by the YTT Secunet policy, cryptography and infrastructure teams
- 5
- beats in the archive: architecture, enforcement, engineering, governance, regulation
- 56 min
- total reading time across the archive; the longest post runs 6 minutes
- 7
- named authors, each responsible for the system they write about
12 posts shown
- A self-hosted vLLM fallback that keeps sovereign routes aliveAn open-weight model on vLLM in your own data centre is the last resort when in-region providers fail. How to size it, lock it down and prove it works.Vikram Desai4 min readEngineering
- DORA's register of information when the ICT provider is an AI modelHow a bank records model APIs and an inference gateway in the DORA register: which templates, which location fields, and how to check them against receipts.Sanjay Kulkarni5 min readGovernance
- Answering security questionnaires about AI residency, line by lineBuyers now send AI addenda asking where prompts are processed, who can reach them and for how long. How to answer precisely, with evidence attached.Deepa Nair5 min readGovernance
- What Meta's EUR 1.2 billion transfer fine teaches AI teamsThe Irish DPC fined Meta EUR 1.2 billion in May 2023 over SCC transfers after Schrems II. What that decision means for prompts sent to model APIs.Meera Krishnan5 min readEnforcement
- Failover without leaving the jurisdiction: a design for outagesLatency-sorted fallback lists are how EU prompts reach Virginia during an outage. Per-jurisdiction failover graphs, fail-closed errors and game days.Kabir Malhotra6 min readArchitecture
- Article 10 of the AI Act, for teams that only call a model APIArticle 10 governs the data behind high-risk AI systems. What it asks of an LLM app built on a provider's API, what it does not, and the new 2027 dates.Meera Krishnan6 min readRegulation
- Pseudonymize before inference: what the model needs and what it doesn'tMasking names and IBANs before a prompt reaches the model, with the mapping kept in-region. What works, what leaks, and where the law sits after SRB.Rahul Sethi4 min readEngineering
- Writing Rego for GDPR transfers: a policy your DPO can readA worked OPA v1 policy for Chapter V routing decisions: adequacy as data, deny reasons a lawyer can audit, and tests that pin the legal intent.Meera Krishnan4 min readEngineering
- Frankfurt to Virginia: the latency floor no CDN can buy backLight in fibre sets a 65 ms round-trip floor from Frankfurt to Ashburn. Here is where that cost lands in an LLM request and how to measure it yourself.Vikram Desai4 min readEngineering
- Merkle receipts: residency evidence a DPA can verify without trusting usHow YTT Secunet signs a receipt for every inference call, commits it to an hourly Merkle root, and lets an auditor check inclusion offline.Rahul Sethi4 min readEngineering
- Why an EU region is not sovereignty, and what to ask insteadPicking eu-west in a console fixes latency and storage location. It does not change which legal entity controls the service or which laws can reach it.Baljit Singh4 min readArchitecture
- Schrems II was never about storage. It was about access in the clearTeams keep answering Schrems II with a storage map. The CJEU asked who can read the data and under what law. For LLM inference, that answer is harder.Meera Krishnan5 min readRegulation
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.