Verifiable neutrality
We route on the merits — and you can check.
An independent control plane is only credible if its independence is auditable. This page states, plainly, where we process and on what basis we choose — so the claim is verifiable, not just asserted.
How a backend is chosen
For each request, the control plane filters and ranks candidate systems in a fixed, auditable order. The rationale for every decision is recorded.
- Residency. Only systems that satisfy your tenant's residency policy remain. A sovereign policy keeps only NZ-located, NZ-owned systems.
- Health. Only systems currently passing health checks and serving the requested model remain.
- Cost. Among the compliant, healthy candidates, the lowest-cost one is chosen, with a deterministic tie-break — no hidden preference.
If that filtering leaves nothing for a sovereign workload, the request fails closed. We never substitute a non-compliant system to make a request succeed.
Processing providers
The current pool, with jurisdiction and ownership. This mirrors the sub-processor list in the Trust Center; the two are kept consistent.
| Provider / role | Jurisdiction | Ownership | Eligible for sovereign workloads |
|---|---|---|---|
| FPC NZ inference node | New Zealand | NZ-owned | Yes |
| FPC control plane host | New Zealand | NZ-owned | Yes |
| Burst / non-sovereign capacity (if enabled) | Varies — labelled per provider | Tagged | No |
A future iteration will publish this pool and its live health directly from the running control plane, so the page is not just accurate but continuously verifiable. Until then it is maintained by hand and reconciled against the gateway's registry.