Follow one request through the lock.
Swap one base_url and your OpenAI SDKs and streaming sail through three gates.
The gate closes behind you.
Before a byte leaves, the prompt clears 60+ detectors and everything found is reversibly pseudonymized.
Persons, organizations and locations are hard to catch by pattern alone, so entity detection is five layers you opt into: context heuristics (persons), email correlation, a tenant name directory, a shipped name dictionary compiled from government open data, and a multilingual recognition model that ships inside the deployment and never sends text to a third party for scanning. The model comes in two selectable tiers: a fast one that answers in single-digit milliseconds, and a deep one (GLiNER2-PII) that catches meaningfully more for a few hundred milliseconds per scanned segment. Measured numbers per tier are in the docs.
Opt-in prompt-injection and jailbreak detection runs at the same gate (Llama Prompt Guard 2, Built with Llama), concurrently with the entity scan, in log or block mode; hits land in the audit trail, and the scan fails open so it never takes down traffic.
Work with personal data and secrets. The model never sees them.
The scan swaps each PII value and secret for a stable token and forwards only tokens to the model. “Anna de Vries” becomes «PERSON_1», consistently across the whole conversation, so the model can keep reasoning. The answer arrives with tokens and leaves the lock with names: restoration happens inside the stream, as tokens come in, so your user notices nothing. The mapping table stays inside. Always.
The water level equalizes.
You define per key which models, regions and owners are allowed; if one fails, the next takes over.
EU-sovereign by default
The default is the strictest setting: only EU-owned providers such as Mistral and Scaleway, plus EU-region clouds. Direct US and Chinese providers are available too, off by default: allow them in policy and Sluis enforces that exact line.
Ownership, not just region
Every model carries a label: where it runs and who can reach it. A US parent under the CLOUD Act is right there on it (owner_is_eu = false), so a direct US or Chinese route is always a choice you see, never one made for you.
Hard blocks, not best-effort
If no provider satisfies the policy, the request is denied at the gate and returned to your app with a clear reason code. A block, not a best guess.
One endpoint. Always the best model.
Policy before benchmark: the same sluis/auto alias resolves differently per tenant when policy requires it. An EU-only org is never routed to a non-compliant provider, even when benchmarks say it is fastest.
Call one stable name
Use sluis/auto for per-request routing or use-case names like sluis/code, sluis/cheap and sluis/vision. Model ids leave your app.
Refreshed from live benchmarks
Managed routes are refreshed daily from Artificial Analysis benchmark data, then curated by Sluis before they become active.
Your policy wins
Your tenant aliases can reuse a reserved name and shadow the managed route. Keys can allow-list sluis/auto or sluis/code just like a model id.
Rankings: Artificial Analysis · targets re-evaluated daily, always resolved within your residency policy.
# One stable name. Tenant policy still decides the target. $ curl https://api.sluis.ai/v1/chat/completions \ -H "Authorization: Bearer $SLUIS_KEY" \ -d '{ "model": "sluis/auto", "messages": [...] }' # → x-sluis-route: sluis/auto # → x-sluis-model: mistral/mistral-large-latest # → x-sluis-region: EU · policy-aware
The passage goes in the ledger.
Every request lands in a hash-chained ledger you can export as JSON Lines and re-verify offline.
Right to erasure (GDPR Art. 17 and equivalents) purges request content, cache and provider credentials, and preserves the metadata chain, so verify-chain still passes after the data is gone.
Your agents pass the same three gates.
MCP tool calls are requests like any other, so they pass the same three gates. An agent reading your CRM or creating a ticket does it behind the lock: inspected, routed, sealed.
The only MCP gateway where every tool invocation passes Inspect → Route → Seal, so “it stayed inside your policy” covers your tools, not just your prompts.
- inspect
Inspect the tool call
The same DLP pass scans tool arguments and results for PII and secrets first.
arguments · scannedpass - route
Route the tool egress
A tool egress outside your residency policy is blocked at the gate.
egress · eu-sovereignin-region - seal
Seal it in the same ledger
The tool call and a hash of its arguments chain into the same tamper-evident ledger.
ledger · #4f9c2averified
tool.callinspect.passroute.eu-sovereignseal.#4f9c2aBuilt to stay out of the request's way.
Compliance can't cost you latency. The hot path is engineered so the controls run without ever blocking on a database, a lock, or a buffer.
Stateless by design
No per-request state, so you scale by adding replicas; the hot path never touches Postgres.
Sealed off the hot path
Audit writes are async and batched, so the response never waits on the ledger.
Streamed, never buffered
SSE streams straight through a tee; the body is never fully held in memory.
Spend that can't drift
Spend is debited in real money and reconciles from the durable ledger; it fails closed.
Measured, not promised
Every gate on, measured overhead is +1 ms at the median, nothing against a live model.
Document anonymization
Hand the gateway a docx, a pdf, an image, or plain text and get the same document back with every name, number, and secret swapped for «MERGE_TAG»s in text and blurred out of pixels. Rendering and OCR run inside the gateway process; nothing reaches a model provider, the operation is sealed in the audit chain, and the token mapping is yours alone.
Pay once for the same answer.
Turn on exact-match and semantic caches per tenant, tenant-isolated and AEAD-encrypted, without ever weakening residency.
Built for the stack you already have.
OpenAI-compatible to the byte. Keep your SDK, your prompts, your tooling. Point one base_url at Sluis and add a residency header when you want to pin a class of traffic.
OpenAI-compatible API
/v1/chat/completions, /v1/embeddings, /v1/models: same request shapes, same streaming, nothing to rewrite.
Works with your existing SDKs
Official OpenAI clients, LangChain or plain curl: no new library, no proprietary protocol.
One base_url, one key
Mint a virtual key per app, each with its own model allow-list, limits and budget.
Observability built in
Prometheus metrics and OTLP traces, labelled jurisdiction, owner and decision, straight into Grafana.
# Same API. One endpoint. You set the residency policy. # eu-sovereign is the safe default; allow more deliberately. $ curl https://api.sluis.ai/v1/chat/completions \ -H "Authorization: Bearer $SLUIS_KEY" \ -H "X-Sluis-Residency: eu-sovereign" \ -d '{ "model": "mistral/mistral-large", "messages": [...] }' # → mistral-large @ mistral-fr · in-region # → sealed · #4f9c2a · streamed
See the lock work on your own traffic.
Your provider's list price plus a flat 10%. No seats, no minimums, no markup games. You activate with card or SEPA and pay per use, and no request ever leaves your residency policy.