Allowed launch data
Only intentionally public, deidentified, or pseudonymized proposal material, public sources, and non-sensitive templates or metadata may be sent externally.
Every model call must pass through the provider-neutral gateway, remain eligible for its task and data class, and preserve human control.
Only intentionally public, deidentified, or pseudonymized proposal material, public sources, and non-sensitive templates or metadata may be sent externally.
Identity evidence, credentials, payments, unpublished private workspaces, and unnecessary direct identifiers are blocked.
OpenAI is the production primary only after its gates pass. DeepSeek-compatible endpoints are staging-only and opt-in. Fallback requires equivalent evaluation, region, retention, task, and data eligibility.
Provider, model, prompt version, sources, transformations, privacy mode, and cost are recorded. Structured outputs and citations are validated where required. AI cannot publish or create official action.
External AI stops at the USD 250 monthly cap. Alerts trigger at 50, 75, and 90 percent; an ordinary run estimated above USD 1 requires confirmation.
Inspect the sources, limitations, provider disclosure, and human decision before relying on an output.