Deterministic Consent Gate: analytics remain disabled until explicit opt-in. No third-party trackers are loaded.

NPU
← SPAT NA MANIFEST
NPU Manifesto Series / Volume VI

The Sovereign
API Exit

Why relying 100% on cloud aggregators is an EU compliance trap.

An EU region pin is meaningless if unredacted telemetry still enters an opaque third-party API proxy.

Ne Plus Ultra Global Solutions | Engineering & Architecture

Published September 2026 / Categories: Sovereign API, Cloud Aggregators, GDPR, NIS2, NPU Architecture, Sovereign Standard
Header · The aggregator trap
An EU region pin does not stop unredacted state entering an opaque aggregator proxyCorporate state leaves the estate through a third-party API proxy. GDPR processor chains and NIS2 supplier risk attach to that hop, even when the subscription is labelled EU.ENTERPRISE ESTATEUnredacted stateTelemetry · prompts · IBANEU region pin on paperCLOUD AGGREGATOROpaque API proxySub-processors unknownNo exit · no localityFOURTH PARTYLost controlGDPR Art. 28 chainNIS2 Art. 21(2)(d)
00
Supply-chain risk

The hidden supply-chain vulnerability

Enterprise software that routes 100% of inference, enrichment, or “AI features” through a cloud aggregator has not bought a model. It has bought a hidden processor chain. The aggregator sits between your estate and someone else’s GPU. Your prompts, telemetry, and document fragments become that vendor’s input. Their sub-processors — often unnamed, often extra-EU — become yours under GDPR Article 28[1].

Choosing an “EU region” on the aggregator’s marketing page does not change the hop. If unredacted telemetry and sensitive state still enter an opaque API proxy, you have already performed a disclosure. Article 32 asks for appropriate security of processing, including pseudonymisation. Chapter V asks whether a transfer is lawful. An aggregator that can see the raw payload is not a region. It is a processor you may not be able to instruct, audit, or exit.

NIS2 Article 21(2)(d)[2] makes the same fact a cybersecurity duty. Essential and important entities must manage supply-chain security, including the relationships with direct suppliers and the quality of those suppliers’ own practices. A single aggregator SDK that fans out to four model vendors is four suppliers you did not assess, wrapped as one invoice. DORA[3] then asks financial entities whether they can leave.

That is the compliance trap. The region pin is theatre. The proxy is the control plane. The Compliance Paradox stated it for landing zones. This paper states it for the API. The Post-Quantum Trap already showed why unredacted cloud pipes are an archive problem. Aggregators accelerate both failures.

01
Three-tier sovereign defense

Redact locally. Execute directly. Fail over last.

Ne Plus Ultra Global Solutions exits the aggregator by splitting the path. Nothing raw is allowed to leave Tier 1. Nothing proprietary is allowed to depend on Tier 3.

  • ▪Tier 1 — local edge NPU. Micro-SLMs, PII redaction, IBAN scrubbing, and context pruning run on the node at $0.00 / token. The output is an anonymised AST, not a document dump.
  • ▪Tier 2 — direct sovereign compute. The AST is executed against dedicated open models you can inspect: Together AI[4] bare-metal as one example of contracted dedicated compute, self-hosted vLLM[5] or TensorRT-LLM. No request multiplexer in the path.
  • ▪Tier 3 — frontier gateways. Failover only, and only after deterministic redaction and AST pruning. A frontier vendor that never sees raw corporate state is a bounded tool. A frontier vendor that sees everything is the trap.
Figure 1 · Three-tier sovereign API exit
Local NPU redaction, then dedicated open-model compute, then frontier failover onlyTier 1 redacts on a local NPU. Tier 2 runs dedicated open models. Tier 3 frontier gateways receive only an anonymised AST after deterministic pruning.TIER 1 · EDGE NPURedact · pruneMicro-SLM · PII · IBANContext compression$0.00 / tokenTIER 2 · SOVEREIGNDirect open modelsTogether / vLLM / TRTDedicated / bare metalAST in · AST outTIER 3 · FAILOVERFrontier gatewayAfter deterministic gateNo raw corporate stateOptional · bounded
02
Sovereign Standard

Own the interface. Compile to silicon.

The Sovereign Standard is the operational refusal behind the architecture: zero opaque third-party runtime dependencies, zero vendor lock-in, and proprietary RDKs compiled directly to hardware. Aggregator SDKs fail it on contact. If the only way to call a model is through a vendor client that you cannot compile, you have accepted lock-in and a processor you cannot exit.

Proprietary Rapid Development Kits keep cryptographic and inference interfaces decoupled from any one vendor’s timeline. The kits compile directly to hardware targets — OpenVINO[6], ONNX, QNN — so a change of accelerator or model does not require a change of estate. That is also how NIS2 supply-chain quality is made inspectable: the artefact is yours.

Zero opaque runtime dependencies

Execution logic is not allowed to sit inside a SaaS aggregator’s SDK. If you cannot compile it, you do not own it.

Zero vendor lock-in

Identity, routing, and model interfaces stay behind proprietary RDKs. Changing a provider is a bind, not a rewrite.

Hardware-direct compilation

RDKs compile to OpenVINO, ONNX, and QNN. The accelerator is a target, not a subscription.

03
Tactical migration

A CTO roadmap off the aggregator

  1. Step 01

    Inventory the aggregator chain

    List every outbound API that sees telemetry, prompts, or documents. Name the processor, the sub-processor, and the data classes. If you cannot name them, you already have a GDPR Article 28 and NIS2 Article 21 gap.

  2. Step 02

    Stand up Tier 1 on one node

    Deploy a local NPU path for PII/IBAN scrubbing and AST pruning on a single workflow. Prove that raw state never leaves. Keep a redaction trace.

  3. Step 03

    Bind Tier 2 to dedicated open models

    Point the pruned AST at self-hosted vLLM or TensorRT-LLM, or a dedicated bare-metal contract you can inspect. Do not send the first production cut through an aggregator.

  4. Step 04

    Demote vendor APIs to Tier 3

    Frontier gateways become failover only, and only after the deterministic gate. Contracts should say so. Usage should prove so.

  5. Step 05

    Compile the RDK and test exit

    Replace SDK calls with the hardware-compiled interface. Run a tabletop: aggregator withdrawn in 72 hours. If the workflow still runs on Tier 1 + Tier 2, the exit is real.

The productised cut is the NIS2 cyber-resilience bundle plus the sovereign vending architecture. Do not migrate every workflow in one quarter. Migrate the workflow that currently dumps the most state into the proxy.

“The region pin is theatre. The proxy is the control plane.”
NPU Doctrine / Sovereign Standard

Leave the aggregator

A cloud aggregator that sees raw corporate state is a processor you may not be able to instruct, audit, or exit. GDPR Article 28, NIS2 Article 21(2)(d), and DORA all attach to that hop.

Redact on a local NPU. Execute on dedicated open models. Use frontier gateways only after the AST gate. Compile the interface to hardware. That is the sovereign API exit.

Continue with the core engineering offerings or a contact / B2B inquiry.

Page Title
The Sovereign API Exit: Why Relying 100% on Cloud Aggregators Is an EU Compliance Trap | Ne Plus Ultra
Meta Description
Why routing unredacted enterprise state through cloud aggregators fails GDPR, NIS2, and exit duties. How a three-tier NPU architecture gets you off the proxy.
Slug
/blog/sovereign-api-exit-cloud-aggregators-eu-compliance-trap
Keywords
Sovereign API, Cloud Aggregators, GDPR, NIS2, NPU Architecture, Tech Sovereignty, Sovereign Standard

Sources

  1. [1]Regulation (EU) 2016/679 (GDPR), including Article 28 processors/sub-processors, Article 32 security of processing, and Chapter V transfers.
  2. [2]Directive (EU) 2022/2555 (NIS2), including Article 21(2)(d) supply-chain security for essential and important entities.
  3. [3]Regulation (EU) 2022/2554 (DORA), ICT third-party risk and exit strategies for critical or important functions.
  4. [4]Together AI documentation — dedicated / bare-metal inference as an example of contracted compute, not a claimed partnership.
  5. [5]vLLM documentation — self-hosted high-throughput LLM serving.
  6. [6]Intel OpenVINO — compile and deploy models to local accelerators.

Enterprise audit

Inventarizovat retazec agregatorov

CTO: poziadajte o inventar API, ktore este vidia neredigovany stav, a 72-hodinovy exit tabletop pre najhorsi hop.

architecture@neplusultra.eu
Zobrazit architekturuB2B dopyt