Built from the ground up with a zero-trust security model. Your data is protected at every layer, and the strongest layer is that the confidential value never reaches the AI at all.
We don't keep confidential data in your country. We make sure there isn't any confidential data to keep.
Every other “compliant AI” answers the residency question with a location, a region you select and a policy you trust. Untraceable answers it upstream: the real value is cloaked on your computer before any model sees it, so the thing residency laws exist to protect never enters the pipeline. In the meantime, we do store the sensitive-value stripped audits inside your selected residence, and per-project, so you can serve customers in multiple countries and respect local laws.
Confidentiality law, HIPAA, PIPEDA, Quebec Law 25, the disclosure clauses in an NDA, is built around a moment of disclosure: a confidential value leaving your control and reaching someone else. Untraceable removes that moment. The AI never receives the value, so the obligations that hinge on disclosure don't even attach to the AI step in the first place. The safest way to comply with a rule about sharing data is to never share the data.
We don't stop there. We still run the assessments, still honor residency, still keep an audit trail of every cloak and every submission, not because the law forces us to at that step, but because regulated clients deserve to see the belt and the braces. Doing the work you're not strictly required to do is the whole posture.
Every route authenticated via JWT. Least privilege on Key Vault, database, and Graph. No exceptions.
AI models receive only cloaked data, never your files, never your raw text. Documents stay in your vault.
A cloak-coverage test, a sentinel that catches stray numerical and alphanumeric values, a breach test in which a separate model tries to reconstruct the real values, and a compulsory human certification. Recover even one value and the submission is rejected, zero tolerance, not a threshold.
Contractual guarantee: your inputs are excluded from AI model training. Period.
No memory retention. Session data is cleared immediately after processing. Nothing persists.
Choose your server location: US East Coast or Canada, which is enforced, not just selected. West Europe (Netherlands) is planned and not yet available.
Privacy-by-design tools aligned with HIPAA, PIPEDA and GDPR principles. This is an alignment claim, not a certification: no third-party attestation is held today.
Where cloaks, audit records and compute do live, they stay put. Each region has its own isolated compute and storage. AI inference is the exception and we say so plainly: no model we offer is deployed in Canada, so inference runs in the US or on global deployments, on cloaked text, disclosed up front, never a silent cross-region switch.
Trust center
Subprocessors, residency, retention, encryption, key custody and certification status stated plainly. Where a row is not yet answerable it says so rather than inferring an answer.
Third parties that receive data in the course of delivering the service. AI providers receive cloaked text only, never a confidential value.*
Where cloaks, audit records and compute live. AI inference runs in-region where the provider offers an in-region endpoint; where it does not, the model runs in the US or on a global deployment, on cloaked text,* disclosed up front, never a silent cross-region switch.
No third-party attestation is held today. The rows below state status, not aspiration.
* One exception, and only by the operator's explicit choice. When assigning Advanced (SSA) dimension flags, an operator may elect to have a model propose them instead of assigning each one by hand. That request sends the paragraph text, including the clinical values, to an Azure OpenAI deployment Untraceable operates, so for that request those values do reach our infrastructure and the model does see them. Identifier classes are replaced with labels first: names, patient and investigator identifiers, dates, locations, organisations and email addresses, including ones the operator did not flag. The values are used to produce the flags and are not stored: the audit record replaces every value with a hashed label. The feature is off by default, requires a per-run confirmation showing exactly what will be sent, and every use is recorded in the Untraceable Protocol, value by value. We offer it as an accelerator and recommend assigning the flags manually, or staying with Rapid (SLC) cloaking, wherever the effort allows.
Need something not listed here? Ask us directly, or read the Untraceable Protocol.
Every model receives cloaked text only, never a real value. Storage and compute follow your project's region; AI inference does not.
| Model | Provider | Band | Served via | US projects | Canadian projects |
|---|---|---|---|---|---|
| Claude Opus 5.5 | Anthropic | Frontier All plans | Azure AI Foundry, East US 2 · DataZoneStandard (US data zone) | US East 2: in-region (US data zone) | Served from the US, not in Canada |
| Claude Opus 5.0 | Anthropic | Frontier All plans | Azure AI Foundry, East US 2 · GlobalStandard | US East 2 / global deployment | Served from the US, not in Canada |
| Claude Sonnet 4.6 | Anthropic | Near-Frontier All plans | Azure AI Foundry, East US 2 · GlobalStandard | US East 2 / global deployment | Served from the US, not in Canada |
| Claude Haiku 4.5 | Anthropic | Near-Frontier All plans | Azure AI Foundry, East US 2 · GlobalStandard | US East 2 / global deployment | Served from the US, not in Canada |
| GPT-6 Sol | OpenAI | Frontier All plans | Azure AI Foundry, East US 2 · DataZoneStandard (US data zone, Responses API) | US East 2: in-region (US data zone) | Served from the US, not in Canada |
| GPT-6 Astra | OpenAI | Flagship Frontier Lite+, Advanced, Enterprise | Azure AI Foundry, East US 2 · GlobalStandard (Responses API) | US East 2 / global deployment | Served from the US, not in Canada |
| GPT-5.6 Sol | OpenAI | Frontier All plans | Azure AI Foundry, East US 2 · GlobalStandard (Responses API) | US East 2 / global deployment | Served from the US, not in Canada |
| GPT-5.6 Terra | OpenAI | Near-Frontier All plans | Azure AI Foundry, East US 2 · GlobalStandard (Responses API) | US East 2 / global deployment | Served from the US, not in Canada |
| GPT-5.6 Luna | OpenAI | Near-Frontier All plans | Azure AI Foundry, East US 2 · GlobalStandard (Responses API) | US East 2 / global deployment | Served from the US, not in Canada |
| GPT-5.4 | OpenAI | Frontier All plans | Azure AI Foundry, East US 2 · DataZoneStandard (US data zone) | US East 2: in-region (US data zone) | Served from the US, not in Canada |
| GPT-5.4 mini | OpenAI | Near-Frontier All plans | Azure AI Foundry, East US 2 · DataZoneStandard (US data zone) | US East 2: in-region (US data zone) | Served from the US, not in Canada |
As of 2026-09-24. Flagship Frontier models are included with the Lite+, Advanced, Enterprise plans; every other model is available on every plan. No model in this list runs in Canada; Canadian projects are served from the US or a global deployment, on cloaked text.