Launch HN: Consus (YC F24) – LLM gateway for companies handling sensitive data
Consus launches an LLM gateway specifically designed for companies handling sensitive, regulated data, particularly in the aerospace and defense sectors. It solves the significant challenge of integrating cutting-edge AI while ensuring strict compliance with regulations like ITAR and FedRAMP High. This niche but critical solution resonates on HN due to the pervasive concerns around data privacy and regulatory hurdles in AI adoption.
The Lowdown
Consus, a YC F24 startup, has unveiled an innovative LLM gateway engineered to enable organizations handling sensitive and controlled unclassified information (CUI) to leverage AI tools securely and compliantly. This offering is particularly vital for the aerospace and defense industries, where regulatory frameworks like ITAR and FedRAMP impose stringent data protection requirements.
- Founding Vision: Founder Eric Mags, with a background at SpaceX and Castelion, experienced firsthand the compliance red tape hindering AI adoption in defense, inspiring Consus.
- The Problem: Many highly regulated companies are hesitant to use AI due to fears of data leakage, violating compliance (e.g., ITAR), or failing cyber assessments, despite recognizing AI's potential.
- Consus's Solution: The company provides a compliant AI inference layer that integrates with various AI tools (ChatGPT, Claude, open-source models), ensuring all requests route through ITAR and FedRAMP-compliant infrastructure.
- Key Innovation - Compliance Suffix: Consus enforces a 'compliance suffix' (e.g.,
gpt-5.6-sol:fedramp-high) on all model names, rejecting bare names and ensuring requests hit appropriate compliant environments. - GovCloud Simplification: It abstracts away the complexity of managing multiple government cloud environments (AWS GovCloud, Azure Government) to access diverse compliant models, providing a single endpoint for users.
- Zero Data Retention: Consus strictly implements zero data retention for customer prompts and completions, which are held only in memory for the request duration and never logged or written to disk, ensuring maximum data privacy. Metadata for billing and auditing is retained.
- Business Model: Not a self-serve platform, Consus requires organizational verification and contracts to issue API keys, aligning with ITAR requirements, and charges a compliance fee plus token costs.
By handling the intricate compliance work, Consus aims to accelerate the secure adoption of AI across highly regulated sectors, allowing these industries to benefit from advanced AI capabilities without compromising data integrity or regulatory adherence.
The Gossip
Data Deletion Deliberations
A primary concern among commenters centered on the absolute assurance that sensitive data would not be retained, leaked, or used for model training. The founder clarified that Consus has contractual agreements with model providers preventing data use for training and enforces strict zero data retention on its own platform. Further discussion addressed the nuance of 'abuse monitoring' by model providers in GovClouds, where automated systems might temporarily retain flagged requests (e.g., AWS GovCloud for GPT-5.x models), which Consus is actively working to mitigate or disable.
Compliance Canvas Constraints
Commenters explored the breadth of Consus's compliance framework, inquiring about its applicability to other regulated data types like HIPAA. The founder noted that while their current focus is defense, the underlying FedRAMP High controls make HIPAA equivalency a feasible, minor lift. There were also questions regarding Consus's approach to managing compliance for advanced AI features, such as coding agents that interact with local systems or external services. Consus provides onboarding guidance and pre-defined controls for common tools, and the founder acknowledged the potential to extend their org allowlists to manage tools and multi-component pipelines (MCPs) as a natural next step.
Marketplace Musings
The discussion briefly touched upon the competitive landscape. One commenter observed that the space for secure AI integration in regulated industries appears 'crowded,' suggesting that Consus operates within a developing but already competitive market. Another user mentioned an alternative solution they employ (gluondb.com) for similar challenges, highlighting that companies are exploring various approaches to balance technical access with data compliance.