Trust is verifiable.
A lock doesn't ask for trust; it shows you the ledger.
Nothing sails out until your policy opens the gate. EU by default: enforced, not promised.
Every request meets your policy before it meets a model; if nothing qualifies the gate stays shut: blocked, audited, no dispatch.
Sovereign EU
Mistral and Scaleway are French companies on French infrastructure, outside any non-EU government access regime.
Direct US or China
US and Chinese providers route only when your policy allows, flagged by jurisdiction and CLOUD Act.
Your endpoints, your iron
Bring a private or self-hosted model, or run the whole data plane yourself with Sluis Edge.
Erase the content, keep the proof.
An erasure request that destroys your evidence isn't compliance, it's a liability: Sluis removes the content and keeps the proof.
- Request & response content: the prompts and completions held under opt-in retention.
- Cache entries: exact and semantic cache rows for the tenant.
- Provider credentials: stored upstream API keys, decrypted nowhere.
- Content references: every content_ref pointer is nulled.
- The audit metadata chain: audit_log + chain_heads stay intact, so verify-chain still passes.
- Hashes, not content: the SHA-256 links remain; the bodies they covered are gone.
- Routing decisions: which region and provider served each call.
- Token & cost metadata: the real-money micro-euro ledger that backs your budgets.
Retention TTL purge
A scheduled, cron-able purge deletes only the content and cache rows past their TTL.
Content retention is opt-in
By default Sluis records metadata, not the message; storing prompt and response bodies is opt-in.
AEAD-encrypted at rest
Retained content and the entire response cache (exact + semantic) are sealed with authenticated encryption.
Strict per-tenant isolation
Keys, policies, audit chains and cache are scoped to one tenant, enforced on the hot path.
Hand the auditor the chain. They verify it without trusting a word we say.
Every passage is hash-chained to the last, so altering one field breaks every later link; export as JSON Lines and re-verify offline.
$ sluis audit verify-chain --tenant <id> → ok · 1,284,901 entries · genesis intact
Provider exposure, region and ownership, stated plainly.
Representative routes show why hosting region and legal ownership are separate controls under laws like the CLOUD Act.
Sensitive data is caught at the first gate, before it reaches a model.
60 deterministic detectors scan every request for PII, PHI and secrets, built for regulated data everywhere: from the US Social Security number to a national-ID pack that checksum-validates 12 EU countries.
The same engine anonymizes whole documents: docx, pdf, images, and text go in, the same document comes out with PII as «MERGE_TAG»s and image regions blurred, rendered and OCR'd inside the gateway so nothing ever reaches a provider. Redacted PDFs keep an invisible searchable layer of the anonymized text, and async jobs deliver results through time-limited signed URLs.
Names defeat pattern matching, so detection is five layers you switch on deliberately: context heuristics, email correlation, a tenant name directory, a shipped name dictionary compiled from government open data, and a recognition model that runs inside the deployment, so text never leaves your perimeter. Two selectable model tiers trade latency for catch rate: fast (spaCy) or deep (GLiNER2-PII).
We publish what each tier actually catches: measured accuracy per model and language, method and caveats included, in the docs benchmark table.
Opt-in prompt-injection and jailbreak detection runs at the gate in log or block mode, with an org-configurable threshold; hits are sealed in the audit trail and the scan fails open. Opt-in key-behaviour anomaly detection runs as a background job with per-key baselines and an isolation-forest layer; alerts are explainable, never a bare score, in the console Security tab and optionally by email.
Built with Llama. The prompt-injection scan model is Llama Prompt Guard 2 86M, used under the Llama 4 Community License.
Work with personal data and secrets. The model never sees them.
PII and secrets become stable tokens like «EMAIL_1» before the prompt leaves your network, and the map restoring them never touches disk.
Everything your reviewers ask for, ready to hand over.
The paperwork that usually takes three weeks: request any of it directly, no sales call needed to read a DPA.
Bring your auditors. We'll bring the chain.
Residency enforced on every request, content you can erase without losing the proof, and a ledger anyone can check offline. Come test them.
Regulated buyer? Ask about Sluis Edge →