A dedicated Ultrac instance in your jurisdiction.
For governments and regulated infrastructure: an isolated, single-tenant Ultrac instance we stand up in your region and operate to your controls. Zero data retention. No training on your data. Prompt-level audit, SSO/RBAC, and a contractual data boundary.
Audit the deployment boundary.
A Sovereign instance includes checks for isolation, residency, zero retention, audit logging, and key revocation.
- Prompts and outputs are discarded after each request; retention is contractually zero.
- Your data never enters any training or fine-tuning corpus - a contractual commitment, not a flag.
- The instance is single-tenant and pinned to your jurisdiction, on a dedicated hostname.
- Every request is logged at prompt level to a sink you operate, and keys are revocable on command.
Contracted boundary - illustrative tenant
- endpoint
- acme-gov.sovereign.ultrac.io, single-tenant
- region
- pinned eu-sovereign-1, in-jurisdiction
- retention
- 0 days; prompts and outputs discarded after serving
- training
- your data excluded from every corpus, contractual
- audit
- prompt level, streaming to a sink you operate
- keys
- bound to your SSO identity, revocable on command
Isolated, in-jurisdiction, and kept by no one. Including us. Each line is a term of the deployment contract, and every one of them is written into the data policy below before an instance is stood up.
Three hosting options for Cosmic 1.
Every option uses Cosmic 1. The difference is tenancy, jurisdiction, and data handling.
Shared API
The OpenAI-compatible API on the shared pool, under the per-request limits of your plan. Point your existing client at our endpoint and you are live in minutes - the quickest way to evaluate Ultrac before committing to isolation.
- Endpoint
- https://ultrac.io/v1
- Tenancy
- Shared · multi-tenant pool
- Limits
- Per-request plan limits, not tokens
- Operated by
- Ultrac · fully managed
Dedicated instance
Isolated capacity provisioned in your region and reserved for you, operated by Ultrac. Single-tenant throughput, your own SSO and RBAC, and a data boundary agreed in writing.
- Endpoint
- https://ultrac.io/v1
- Tenancy
- Single-tenant · dedicated
- Region
- Pinned to your region
- Operated by
- Ultrac · your controls
Sovereign instance
A dedicated, isolated Ultrac instance in your jurisdiction or a government region, operated by us to your controls. Zero data retention, prompt-level audit, SSO/RBAC, and a contractual data boundary - on a dedicated hostname of your own.
- Endpoint
- https://<tenant>.sovereign.ultrac.io/v1
- Residency
- Pinned to your jurisdiction
- Retention
- Zero · no training on your data
- Operated by
- Ultrac · to your controls
Sovereign data-control guarantees
Written into the contract| Control | Commitment | How the boundary holds |
|---|---|---|
| Data retention | Zero retention | Prompts & outputs discarded after serving |
| Model training | Never on your data | Contractual, in the master agreement |
| Isolation | Single-tenant | Dedicated capacity & hostname |
| Residency | In-jurisdiction | Pinned to your region |
| Audit | Prompt-level logging | Exportable to your SIEM |
These are contractual commitments, not defaults you have to configure. Exact scope - logging detail, retention windows, region, and RBAC policy - is confirmed with you during the data and compliance review before the instance carries any traffic.
# point the OpenAI SDK at your dedicated Sovereign endpoint
from openai import OpenAI
client = OpenAI(
# your isolated, in-jurisdiction instance - still ours, operated for you
base_url="https://acme-gov.sovereign.ultrac.io/v1",
api_key="ULTRAC_SOVEREIGN_KEY", # issued to your SSO identity, revocable
)
resp = client.chat.completions.create(
model="cosmic-1",
messages=[
{"role": "system", "content": "You are a defensive security analyst."},
{"role": "user", "content": "Triage this intrusion timeline."},
],
)
print(resp.choices[0].message.content)Deployment process.
Five stages. You know at every point what we hold, what you hold, and exactly what the data boundary permits.
Briefing
Week 0A single technical call - no procurement theatre. What the agent does, where the capability line actually sits, and whether a Sovereign instance is the right shape for you at all.
- Under NDA on request
- Engineering-to-engineering
- Written capability summary
Data & compliance review
Weeks 1-2We map your data-handling requirements before we provision anything: who may query, what is logged, how long anything is held, which jurisdiction the instance must sit in, and which framework you are accrediting it against.
- Data-handling boundary
- Residency & jurisdiction
- Retention & audit requirements
Provisioning the isolated instance
Weeks 2-4We stand up dedicated, single-tenant capacity in your region on a hostname of your own, configured to your controls: zero retention, no training on your data, and a contractual data boundary agreed in writing before it carries a single request.
- Single-tenant capacity
- In-jurisdiction hosting
- Contractual data boundary
Onboarding & key issuance
Weeks 4-6We wire your SSO and RBAC, issue API keys scoped per role, connect the audit trail to a sink you already operate, and tune throughput against your production workloads. Then operator training for your analysts.
- SSO/RBAC + key issuance
- Audit sink integration
- Analyst & operator training
Sustainment & 24/7 support
OngoingNamed engineers, an agreed response clock, and a change process you sign off on. Keys are revocable on your command, and the data boundary holds for the life of the contract.
- 24/7 named support
- Revocable keys
- Quarterly eval refresh
Timings are indicative for a single-instance deployment and move with your accreditation process, region availability, and compliance review.
Contractual deployment guarantees.
Every lever below is a contractual commitment on your instance. We operate the capability; your authorising body decides what it is accredited to do.
Zero data retention
Prompts and outputs are held only long enough to serve the request, then discarded. Retention is contractually zero unless you explicitly ask us to log, and the boundary is written into the agreement.
No training on your data
Your prompts, files, and outputs never enter any training or fine-tuning corpus. This is a contractual commitment, not a setting - it does not depend on a flag you have to remember to set.
Prompt-level audit logging
Every request, identity, and tool invocation can be written to your own sink - syslog, S3-compatible object store, or a SIEM you already operate. You control what is captured and how long it is kept.
SSO & role-based access
Keys and roles bind to your identity provider. Scope Cosmic 1 access, context length, tool access, and rate limits per role, per team, per programme - and revoke any of it instantly.
In-jurisdiction hosting
The instance is provisioned in your jurisdiction or an approved government region and pinned there. Your data is processed where your law and your accreditation require it to stay.
Accreditation support
Designed to support your accreditation process with artefacts and engineering time. We do not claim your certification for you - the authorisation of the deployment remains yours to grant.
We claim no certifications on this page. A Sovereign instance is designed to support deployment into accredited environments - zero retention, prompt-level audit, key custody, SSO/RBAC, in-jurisdiction hosting, and a documented data boundary - but any specific authorisation is deployment-dependent and issued by your authority, not by us. We will support the assessment, produce the artefacts, and answer technical questions in writing.
Ultrac is a dual-use capability, and capability needs governance. Sovereign instances carry defensive-use terms, and we expect you to enforce them internally with the same rigour you apply to any other dual-use tool in your inventory.
Sovereign instance
Customannual contract
A dedicated, isolated instance in your jurisdiction, run by us to your controls.
- Dedicated isolated instance
- In-jurisdiction / gov-region hosting
- Zero data retention
- Full audit log of every query
- Onboarding and deployment engineering
- 24/7 named support
Request a dedicated instance in your jurisdiction.
One technical call, engineering to engineering. Tell us the data boundary you have to respect and the work your defenders are currently blocked on.
Sovereign programme · Government & critical infrastructure