ericmags

We've been focused on defense, so we haven't set up HIPAA (BAAs) yet. The underlying controls are essentially FedRAMP High, so it wouldn't be a big lift on our side. If you have a specific use case in mind, drop me a note at founders@consusindustries.co and we can talk more about it.

Great call. We already block certain tool schemas and flag URLs in tool-call arguments, and since we enforce org allowlists for models on every request, extending that to tools/MCP is a natural next step.

The infra providers call this "abuse monitoring" or "abuse detection" and we've worked with them to turn it off. We don't serve models like Fable that require it. We have one case remaining for OpenAI's GPT-5.x models in AWS. AWS's automated classifier can retain a flagged request for up to 30 days. Per AWS, that review is automated with no human access, the data stays in AWS GovCloud, and it's never shared with OpenAI. We are actively working to turn that off as well. Everything else is covered.

We do give our customers guidance to make sure they are thinking about this properly. This typically happens during on-boarding.

We also built out pre-defined controls for common tools so they can click a button and not think about it.

Glad you like the compliance suffix.

W.r.t observability: We don't use any third-party error tracker, APM, or queues. If any request fails, the client gets an error message that we write as opposed to the raw provider error. On our side, every log lives inside our boundary, and is written from a field allowlist (ids, model, token counts, status, latency). The JSON is purposely stripped away so any details in the request do not land in our logs.

Correct. We have contractual agreements to ensure no data that passes through our platform will be used for model training purposes. In addition, we have in our contracts that we (Consus) will also not use any data for training purposes. We couldn't if we wanted to since we do not store any prompt data.