Data residency by default. No inference call crosses borders without explicit policy approval. No model is fine-tuned on your data.