Skip to main content

Provider data and routing

Use providers.targets[].data_policy to record retention and training terms from your provider contract. Add data-routing-policy to filter targets by this customer-declared metadata.

Provider data_policy blocks​

data_policy is data for a provider target. It does not change a route by itself. Add data-routing-policy to the chain to apply it.

providers:
  targets:
    - id: openai-zdr
      provider: openai
      model: your-openai-model
      secret_key_ref:
        env: VERDICTAN_OPENAI_API_KEY
      data_policy:
        zero_data_retention: true
        training_opt_out: true
        retention_days: 0
FieldTypeNotes
zero_data_retentionbooleanRecord true only when your provider terms specify zero retention.
training_opt_outbooleanRecord true only when your provider terms exclude model training.
retention_daysintegerRecord the retention period in days. A value of 0 means no retention.

data-routing-policy​

data-routing-policy filters the provider target list before the usual route and fallback operations.

policies:
  chain:
    - data-routing-policy
    - audit-logger

policy:
  data-routing-policy:
    require_zero_data_retention: true
    require_no_training: true
    max_retention_days: 0
    on_no_compliant_provider: block
    log_provider_selection: true
FieldTypeNotes
require_zero_data_retentionbooleanThe policy keeps only providers with zero_data_retention: true.
require_no_trainingbooleanThe policy keeps only providers with training_opt_out: true.
max_retention_daysintegerThe policy removes providers for which retention_days is more than the limit.
on_no_compliant_providerstringblock or warn.
log_provider_selectionbooleanThe policy emits diagnostic data that identifies removed targets.

Use block for a hard routing requirement. With warn, the gateway continues with the complete target list when no target satisfies the declared limits.

Full example​

pack:
  name: config-data-policies-example
  version: 1.0.0
  enabled: true
providers:
  targets:
    - id: trusted-zdr
      provider: openai
      model: your-openai-model
      secret_key_ref:
        env: VERDICTAN_OPENAI_API_KEY
      data_policy:
        zero_data_retention: true
        training_opt_out: true
        retention_days: 0
    - id: general-purpose
      provider: azure
      provider_type: azure-openai
      format: openai
      model: your-azure-openai-model
      base_url: https://replace-with-resource-name.openai.azure.com
      secret_key_ref:
        env: VERDICTAN_AZURE_OPENAI_API_KEY
      azure_api_version: your-supported-api-version
      azure_deployment: your-azure-deployment
      data_policy:
        zero_data_retention: false
        training_opt_out: true
        retention_days: 30
policies:
  chain:
    - data-routing-policy
    - audit-logger
policy:
  data-routing-policy:
    require_zero_data_retention: true
    require_no_training: true
    max_retention_days: 0
    on_no_compliant_provider: block
    log_provider_selection: true
  audit-logger: {}

Before you start the gateway, replace all model, deployment, resource, and API version placeholders with active account values.

Route data details​

You can also declare these route requirements:

  • data_policy.allow_internet_egress
  • data_policy.local_only_processing
  • data_policy.in_memory_only
  • data_policy.sanitized
  • data_policy.accepts_tokenized_input
  • data-routing-policy.allow_internet_egress
  • data-routing-policy.local_only_processing
  • data-routing-policy.require_in_memory_only
  • data-routing-policy.sanitize_before_provider
  • data-routing-policy.tokenize_sensitive_fields

Use these fields only when the target metadata agrees with your approved provider terms. The gateway uses the declared values as route limits.

The gateway does not get or verify provider attestations automatically.

The provider data policy does not set audit retention. Set audit retention and storage controls in the platform configuration.

In the active gateway, audit-logger is an allow-only chain marker.

Next steps​