Skip to main content

Zero-Retention Routing

Use this page to configure and verify zero-retention requirements in Verdictan.

This page is not a provider catalog. Provider guarantees can change. Verdictan enforces only the requirements that you declare in the config.

Prerequisites​

  • A correct policy pack with one or more selected providers.targets[].
  • Active provider terms or your organization's approval record that supports each handling guarantee you plan to declare.
  • A gateway verification plan that includes a compliant-target path and a no-compliant-target path.

1. Declare provider handling metadata​

Add data_policy to each provider target that participates in sensitive routing. Replace the resource host, deployment name, API version, and model with values from the Azure deployment your organization has approved.

providers:
  targets:
    - id: azure-openai-zdr
      provider: azure-openai
      model: gpt-5.4-mini
      base_url: https://your-resource.openai.azure.com
      secret_key_ref:
        env: VERDICTAN_AZURE_OPENAI_API_KEY
      azure_deployment: your-azure-deployment
      azure_api_version: your-supported-api-version
      data_policy:
        zero_data_retention: true
        training_opt_out: true
        retention_days: 0
        in_memory_only: true
        allow_internet_egress: false

2. Enforce the routing rule​

policies:
  chain:
    - data-routing-policy
    - audit-logger

policy:
  data-routing-policy:
    require_zero_data_retention: true
    require_no_training: true
    max_retention_days: 0
    require_in_memory_only: true
    allow_internet_egress: false
    on_no_compliant_provider: block
    log_provider_selection: true

The selector evaluates target metadata before usual routing and fallback. A target without the necessary metadata does not satisfy that rule.

When each target is excluded:

  • block returns HTTP 403 without sending the request upstream.
  • warn continues with the full target list.

warn is an observation mode, not zero-retention enforcement. Do not use it for traffic that must stay in the declared boundary.

3. Validate before rollout​

verdictan policy lint --file policy-config.yaml
verdictan policy test --json

Linting finds missing provider targets and missing data_policy blocks. It also finds some declarations that do not agree and configs that exclude all targets.

verdictan policy test runs the declared policy cases in the pack. But the data-routing-policy input-phase result is only a marker. The gateway filters targets during provider selection. Use a gateway request test for the eligible and no-eligible-target paths. The two tests do not validate a provider contract.

After rollout, send an authenticated request through the selected request family. Make sure that the request succeeds only if there is an eligible target. Make sure that a request without an eligible target returns 403 in block mode. If log_provider_selection is enabled, use the gateway log diagnostics as evidence. Also use each delivered request record as evidence.

What Verdictan can prove​

Verdictan can prove that the gateway only routed to provider targets with declared data_policy that matched your requirements.

Verdictan cannot prove the legal or contractual promises of a vendor. The data_policy value is your organization's declaration. It must agree with your accepted provider terms.

  • Use data_policy on each provider target in a sensitive route.
  • Keep data-routing-policy in the active chain. Metadata alone does not filter targets.
  • Use on_no_compliant_provider: block for enforced workloads.
  • Test the eligible path before rollout.
  • Test the no-eligible-target path before rollout.
  • Re-review provider guarantees before changing models, regions, endpoints, or account terms.
  • Preserve the config version and request identifiers used for verification.
  • Record the provider contract, account setting, region, and review date that justify each declaration. A config value without that evidence is not a retention guarantee.

Troubleshooting​

SymptomCheck
Lint says each provider is excludedCompare each policy field in the rule with the matching target data_policy value
Request returns 403Make sure that one configured target satisfies all active routing rules
Request succeeds in warn mode with no compliant targetsThis result is the configured observation behavior. Change the value to block before you identify the route as enforced.
Selected target violates the accepted provider termsCorrect the organization declaration and provider approval process. The gateway cannot automatically verify vendor promises.

Next steps​