# Consus: full site content Every page on https://consus.io as Markdown, one after another. Index: https://consus.io/llms.txt --- title: "Consus — Compliant AI gateway for US defense contractors" description: "Compliant AI gateway for US defense contractors. FedRAMP Equivalent (assessed at the High baseline), ITAR compliant, zero data retention, with the evidence a CMMC assessment needs." canonical: https://consus.io/ --- [Update Consus successfully completed a third-party audit against **all FedRAMP High controls** Audit complete: **all FedRAMP High controls** Audit: **all FedRAMP High controls**](/blog/fedramp-high-audit-complete) # _Your AI Gateway_ for Controlled Data For aerospace, defense, and energy companies. Use the latest AI models on ITAR and CUI data. [Request Access →](https://tally.so/r/QKBYVg) [Book a compliance call](https://cal.com/emagliarditi/consus-gateway-intro-discussion) Diagram: Your AI tools, such as ChatGPT, Claude and custom agents, send encrypted requests to Consus, which routes them inside a US-only, FIPS 140 encrypted boundary to models from OpenAI, Anthropic, SpaceXAI and Google. Trusted by - ![Ridgeline Federal](/customer_logos/ridgeline.svg) - ![Castelion](/customer_logos/castelion.png) - ![Neros](/customer_logos/neros.png) - ![Inversion](/customer_logos/inversion.png) - ![Longshot Space](/customer_logos/longshot.png) - ![Wild West Systems](/customer_logos/wild_west_systems.png) Top Level Compliance Summary Active Zero Data Retention Prompts and completions never persist Nothing you send through Consus is stored, by us or by the model provider. Zero data retention is in place with every upstream model provider, and only operational metadata (model, tokens, timestamps) is logged. Active ITAR Compliant Export-controlled by design The controls ITAR requires are built into how Consus runs: US persons only in the data plane (120.54(a)(5)), US-only cloud regions, and access that is logged and reviewed. Customers remain the registered exporter for their technical data. Active FedRAMP Equivalent Assessed at the FedRAMP High baseline DFARS [252.204-7012](https://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm#:~:text=D,-\)%C2%A0%20If%20the%20Contractor) requires any cloud that handles your CUI to meet FedRAMP Moderate or its equivalent ([DoD memo](https://dodcio.defense.gov/Portals/0/Documents/Library/FEDRAMP-EquivalencyCloudServiceProviders.pdf)). Although only Moderate is required, we worked with our 3PAO and assessed all 410 FedRAMP **High** controls. The body of evidence for your CMMC assessor is available under NDA. [See full compliance details →](/compliance) ![Consus](/consus_logo_lockup.png) ![Inversion Space](/inversion_logo.png) > "LLMs have been a big accelerator for developing our cutting-edge re-entry vehicles, and Consus has been the accelerator we need to get the latest models as quickly as possible while still maintaining compliance." Alex Tacescu · Director of Software, Inversion Space [Read the case study (PDF) →](/case-studies/consus-inversion-space-case-study.pdf) Integrations ## Keep your tools. _Connect them to Consus._ Wire-compatible with the AI applications you use every day. Here is ChatGPT, opened by the Consus Launcher and already set up with an ITAR model. [See all integrations →](https://gateway.consus.io/integrations/) Video: Consus Launcher opening ChatGPT, already set up with an ITAR model [New **Consus Launcher.** Paste your key once, and every tool opens ready.](/launcher) Pricing ## Two plans. Zero token markup. Teams · under 50 employees, ITAR $40 per employee / month Plus AI tokens at provider cost, with no markup. [See pricing →](/pricing) Enterprise · 50+ employees, or any CUI Custom An annual agreement with the Body of Evidence for your CMMC assessment, SSO, and dedicated support. [Book a compliance call →](https://cal.com/emagliarditi/consus-gateway-intro-discussion) ## Execute faster without the compliance headache US-based defense contractors only. Access is granted after a company review and contract. No self-serve. [Request Access →](https://tally.so/r/QKBYVg) [Book a compliance call](https://cal.com/emagliarditi/consus-gateway-intro-discussion) --- title: "Enterprise · Consus" description: "Roll out ChatGPT, Claude Code, Codex, VS Code, or your own apps company-wide in under a day. Your identity provider's groups decide which models each team can call, inside a boundary that's FedRAMP Equivalent, assessed at High." canonical: https://consus.io/enterprise --- Enterprise # Every AI tool your teams want. _Compliant by default._ _Governed by your IdP._ Roll out ChatGPT, Claude Code, Codex, VS Code, or the apps and agents you build yourself, to the whole company in under a day. Your identity provider decides which models each team can call, and every request stays inside a boundary that's FedRAMP Equivalent, assessed at High. [Request Access →](https://tally.so/r/QKBYVg) [Book a compliance call](https://cal.com/emagliarditi/consus-gateway-intro-discussion) < 1 day Contract signed to first request 8+ Tools ready on day one 1 Identity provider for every model decision 0 API keys inside a deployment package Model access ## Your identity provider decides who calls what. Connect Microsoft Entra ID, Okta, Google Workspace, or any OpenID Connect provider. Map each group to a policy once. From then on, people get the right models the first time they sign in, with no ticket and no per-key setup. Org ceiling FedRAMP High + ITAR Group in your IdP Consus policy Their keys can call Flight Software Engineering Every ITAR model Program Office Chat Two approved chat models Everyone else Org default Your baseline - People get the union of their groups' policies, minus anything a restrict policy takes away. Everyone else gets your default. - An org-wide ceiling caps it all. Set it to FedRAMP High + ITAR and no key can call anything outside it. - A request outside policy is refused with "contact your administrator." Tools only list the models the key can call. - Changes reach every key immediately, and each one is logged with the admin who made it. Before Consus With Consus Engineers paste program data into personal AI accounts. They get the tools they asked for, already pointed at Consus. Someone hand-writes config for every tool on every laptop. One package per tool, pushed with Jamf, Kandji, Intune, or Group Policy. Model access is decided key by key, in a spreadsheet. Your identity provider's groups decide. Keys follow automatically. API keys sit in dotfiles, chat threads, and shared drives. No key in any package. The Launcher keeps it in the system keychain. Every new model means another vendor and another review. One assessed boundary and one contract for every model you enable. Rollout ## Signed this morning. On every laptop this afternoon. The Portal builds each package from your organization's model policy. Consus installs nothing and runs nothing on your network. You push the files with the device management you already use. 1. 01 Pick the data ITAR, CUI, or both. Each tool is set up with only the models your policy allows for that data. 2. 02 Pick the tools Claude Desktop ChatGPT Desktop Claude Code Codex CLI Grok Build OpenCode Pi VS Code 3. 03 Push one package Through Jamf, Kandji, Intune, or Group Policy. Each person signs in, creates a key, and pastes one line. The Portal writes the email to your team for you. [Launcher Or skip the paste. The Consus Launcher opens Claude Desktop, ChatGPT, Claude Code, Codex, and Pi already set up.](/launcher) [Build Building your own apps or agents? Point any OpenAI-compatible client at api.consus.io. The same policies, budgets, and logs apply.](https://gateway.consus.io) The Portal ## One console for spend, keys, and who can call what. Every key, every dollar, and every policy, visible to your admins. Overview ### Spend & budgets Set monthly budgets per org or per key and watch spend accrue in real time. Know what's left and when it resets. Usage ### Usage analytics Tokens routed, total requests, error-free rate, and P95 latency across 1, 7, 30, and 90-day windows, per key and per org. Keys ### Key ownership Every key has a named owner, set when it's created and never reassigned. Issue, limit, or revoke in seconds, and see every key by person. Policies ### Groups & policies Groups arrive from your identity provider as people sign in. Assign each one a policy, and their keys follow. Models ### Model controls Set an org-wide ceiling by compliance level or by model. Nothing outside it can be called, by any key. Deployment ### Ready-made packages Packages for eight tools on macOS and Windows, built from your model policy, with a note for your team. Day two ## You'll hit these moments. Here's what happens. ### A new hire joins the program They sign in with your identity provider. Their group already maps to a policy, so their first key can call exactly the models it should. ### An engineer leaves on Friday Disable them in your IdP. Revoke their keys in the Portal, or from your offboarding script with the Management API. By Monday there's nothing to clean up. ### A key leaks Revoke it in seconds. Pull its request history from the logs API and know exactly what it was used for. ### Someone asks for a model their team can't use Their tools never listed it. If they call it anyway, the gateway refuses and tells them to contact their administrator. ### An agent loops overnight The key hits its monthly cap and the gateway stops serving it. The worst case is the budget you set, not the invoice you find. ### Finance asks what AI will cost One annual agreement, zero token markup, and usage at provider list price, capped by the budgets you set. The forecast is arithmetic. Security review ## Built to get through your security review. ### Launcher - Open source, Apache-2.0 - Signed by Consus Industries, notarized by Apple - Built only in public GitHub Actions, with SBOMs - No proxy, no telemetry, no background process ### Portal - Sign-in through your identity provider, with MFA - System use notice before every sign-in - Idle sessions signed out automatically - Shows usage metadata, never prompt content ### Packages - No API key in any file Consus generates - Consus installs nothing. You push with your MDM - Built from your policy, never hand-edited - ChatGPT's web search, browsing, and memory off ### Gateway - FedRAMP Equivalent, assessed at High - US-only infrastructure, US persons in the data plane - Zero data retention with every model provider - Prompts and responses are never stored [See the full compliance posture →](/compliance) Management API ## Run Consus from your own tooling. Your organization's management key can't run inference. It runs everything around it: issue and revoke keys, set limits, and read spend and request logs, scoped to your organization alone. Wire it into onboarding, offboarding, your SIEM, or the monthly report your assessor asks for. - `POST /v1/keys` Create a key with a named owner and a monthly limit - `DELETE /v1/keys/{id}` Revoke a key instantly - `GET /v1/keys?owner=` List every key a person owns - `PATCH /v1/keys/{id}/limit` Raise or lower a key's monthly limit - `GET /v1/org` Org caps, model ceiling, and month-to-date spend - `GET /v1/spend` Monthly spend and tokens per key - `GET /v1/logs` Every request: model, tokens, cost, latency, status Keys created here follow the same model policy as keys created in the Portal. Logs are metadata only; the gateway never stores prompts or responses. [Read the Management API docs →](https://gateway.consus.io/management-api) Onboard, offboard, audit ``` # A new engineer starts curl -X POST "https://api.consus.io/v1/keys" \ -H "x-api-key: $CONSUS_MANAGEMENT_KEY" \ -d '{"owner": "dev@example.com", "label": "dev-laptop", "requested_monthly_limit_usd": 50}' # They leave: revoke the key curl -X DELETE "https://api.consus.io/v1/keys/a1b2c3d4e5" \ -H "x-api-key: $CONSUS_MANAGEMENT_KEY" # The assessor asks what it was used for curl "https://api.consus.io/v1/logs?api_key_id=a1b2c3d4e5" \ -H "x-api-key: $CONSUS_MANAGEMENT_KEY" { "request_id": "9c5b2f1a-8d3e-4b6a-9f21-0e7c44aa1b55", "api_key_id": "a1b2c3d4e5", "model": "gpt-5.4:itar", "input_tokens": 1204, "output_tokens": 356, "cost": 0.00897, "latency_ms": 2841, "status": "200" } ``` Questions ## What every first call asks. ### Can we use Consus for CUI and ITAR data? Yes. That is what it's for. Requests run on US-only infrastructure with US persons in the data plane, and each model id carries a suffix such as `:itar` that names the boundary the request runs in. [See the compliance posture](/compliance). ### What is your FedRAMP status? FedRAMP Equivalent, assessed at High. A third-party assessor audited Consus against all 410 FedRAMP High controls. The body of evidence is available under NDA for your CMMC assessment. ### How fast can we be live? Usually the day the contract is signed, often within minutes. There's nothing to deploy: your admins sign in, set policies, and issue keys or push packages. ### Which tools work with Consus? Anything that can point at a custom API endpoint. The Portal builds ready-to-push packages for Claude Desktop, ChatGPT Desktop, Claude Code, Codex CLI, Grok Build, OpenCode, Pi, and VS Code, and the [Launcher](/launcher) opens five of them in one click. ### Can we limit which models each team uses? Yes. Map groups from your identity provider to policies, and set an org-wide ceiling above them. Every key follows its owner's policy automatically. ### What happens when someone leaves? Disable them in your identity provider so they can't sign in, then revoke their keys in the Portal or with one Management API call. A revoked key stops working everywhere at once. ### How do we pay? An annual agreement plus usage at provider list price, with no token markup. Pay by invoice, prepaid credit, or card. [See pricing](/pricing). ### Is there a self-serve plan? No. Consus is for US-based defense contractors. Access is granted after a company review and a signed contract. How to buy ## Live the day you sign. No platform to deploy, no accounts to create by hand. Your developers keep the tools they already use. Consus sits underneath as the compliant inference layer, and the admin controls come with it. 1. 01 Company review We verify you're a US-based defense contractor. No self-serve. 2. 02 Contract Review and sign the Consus Cloud Service Agreement. Compliance documentation is available on request. 3. 03 Admins sign in Through your identity provider. Map groups to policies and push packages. 4. 04 Compliant AI Your teams open the tools they already use and get to work. 99.9% Uptime SLA Every agreement carries a 99.9% uptime SLA. Support tiers scale with your program, up to a shared channel with the engineers who built the gateway. Full terms live in the Cloud Service Agreement. Ways to pay Invoice Prepaid credit Card [See pricing →](/pricing) ## Bring your organization onto compliant AI US-based defense contractors only. Access is granted after a company review and contract. No self-serve. [Request Access →](https://tally.so/r/QKBYVg) [Book a compliance call](https://cal.com/emagliarditi/consus-gateway-intro-discussion) --- title: "Launcher · Consus" description: "Consus Launcher: an open source desktop app for macOS and Windows. Paste a Consus API key once, then open Claude Desktop, ChatGPT, Claude Code, Codex, or Pi already set up for the gateway." canonical: https://consus.io/launcher --- Consus Launcher # Paste a key once. _Every tool opens ready._ A small, open source desktop app for macOS and Windows. Click Claude Desktop, ChatGPT, Claude Code, Codex, or Pi, and it opens already set up for the Consus gateway, with the models your key can call. [Download →](https://github.com/consusindustries/consus-launcher/releases/latest) [View source on GitHub](https://github.com/consusindustries/consus-launcher) macOS 12 or later, Apple silicon or Intel. Windows x64 or ARM64. You'll need a Consus API key from your admin. Video: Consus Launcher opening ChatGPT, already set up with an ITAR model How it works ## One time. Then every tool is one click. 1. 01 Open the portal Sign in the way you normally do, through your company's identity provider. 2. 02 Create a key Name it after the machine and copy it. It's shown once. 3. 03 Paste it in the Launcher It goes into the macOS Keychain or Windows Credential Manager. After that, every tool is one click. The tools ## Five tools, set up the right way. Each tool is set up with the models your key can call, read from the gateway each time the Launcher starts. Your own setup is left alone, and signing out removes only what the Launcher wrote. | Tool | How it opens | Where its settings go | | --- | --- | --- | | Claude Desktop | The app, in gateway mode | Its own gateway configuration. No Anthropic account needed. | | ChatGPT | The app, in Codex mode | Merged into ~/.codex/config.toml, key by key. | | Claude Code | Terminal | Its own profile. Your ~/.claude is never touched. | | Codex CLI | Terminal | Its own profile, apart from ~/.codex. | | Pi | Terminal | Its own profile. Your ~/.pi is never touched. | A tool that isn't installed links to its vendor. Consus never installs software. What it does not do ## A front door, not a gateway. The Launcher writes each tool's settings and opens it. That's all. Your tools talk to the Consus gateway directly, and what a key can call is enforced there, not on the laptop. It makes two kinds of request, both to Consus: the model list for your key, and a public file naming the newest release. The key itself is never written to a file. - No proxy and no TLS interception, ever - No enforcement, monitoring, or config repair - No analytics, telemetry, or crash reporting - No tray icon, autostart, or background process - No local database - No auto-update. New versions come from GitHub Releases For IT admins ## Push it with the MDM you already run. Deploy the signed .pkg or .msi through Jamf, Intune, or Group Policy, then push org settings in a configuration profile (macOS) or the registry (Windows). The Portal's Launcher page writes the settings file for you from your choices. | Setting | What it does | | --- | --- | | EndpointURL | Where every tool sends requests, for example your own logging proxy. Default https://api.consus.io. | | ComplianceLevel | The level every tool is set up for: itar (default), fedramp-low, fedramp-moderate, fedramp-high, il2, il4, or il5, each optionally +itar. | | Tools | Which of the five tools people see. A tool left out has its Launcher settings removed. | | OrgName | Shown in the Launcher's header. | | UpdateNotice | Whether it says when a new version is out. Off by default on managed machines. | Hiding a tool is a convenience, not a control. What a key can call is enforced by the Consus gateway, from the policies in your Portal. macOS bundle ID io.consus.launcher Apple Team ID K4P2D65BQD macOS signing Developer ID, notarized by Apple Windows signing Microsoft Artifact Signing [Full admin guide, including PPPC permissions →](https://github.com/consusindustries/consus-launcher#for-it-admins-org-settings) Install ## Open source, signed, and built in public. - Apache-2.0. Read every line before you deploy it. - Release builds run only in public GitHub Actions, never on a laptop. - Every release ships CycloneDX SBOMs and SHA256SUMS. - Signed by Consus Industries, Inc. on macOS and Windows. [Download the .dmg, .pkg, or .msi →](https://github.com/consusindustries/consus-launcher/releases/latest) macOS, from Terminal ``` $ curl -fsSL https://raw.githubusercontent.com/consusindustries/consus-launcher/main/install.sh | sh # Downloads the latest release from GitHub, checks it against # SHA256SUMS.txt, and installs only if the checksum matches. ``` ## Need a key? Keys come from your Consus admin, in the Portal. Not a customer yet? Start here. [Request Access →](https://tally.so/r/QKBYVg) [Book a compliance call](https://cal.com/emagliarditi/consus-gateway-intro-discussion) --- title: "Pricing · Consus" description: "Two plans, zero token markup. Teams is $40 per employee per month for ITAR workloads under 50 employees. Enterprise is custom, for 50+ employees or any CUI workload." canonical: https://consus.io/pricing --- Pricing # Pay for compliance. _Tokens at cost._ Every model at provider list price, no markup. ITAR teams under 50 start on Teams. Any CUI, or 50+ employees, is Enterprise. ## Teams Under 50 employees · ITAR workloads **$40** per employee / month \+ AI tokens at cost, no markup What's included: - **Works with every AI tool you already use:** Claude Code, Codex, ChatGPT, VS Code and more - ITAR routing for Claude, GPT and Grok models - ITAR attestation - Email sign-in with MFA - Usage dashboard and email support [Request access](https://tally.so/r/QKBYVg) ## Enterprise 50+ employees, or any CUI workload **Custom** Priced to your size, from 5-person CMMC shops to primes \+ AI tokens at cost, no markup Everything in Teams, plus: - CUI routing with CMMC Level 2 support - Single sign-on (SSO) - Body of Evidence and SSP inputs for your CMMC assessment - Usage and audit logs via API, ready for your SIEM - Dedicated support [Talk to us](https://cal.com/emagliarditi/consus-gateway-intro-discussion) Token spend ## How much will I spend in tokens? We are asked this a lot. Use the tool below to get a general understanding. Token spend / user People Per month Heavy users Agentic coding, multi-step workflows $250/mo $100 $1,000 $12,500 Standard users Chat only — writing, research, doc Q&A $10/mo $5 $100 $1,000 Sustained agents Overnight and long-running jobs $1,000/mo $500 $3,000 $2,000 Monthly $15,500 Annualized $186,000 **A range, not a quote.** Defaults reflect what we see in practice. Roughly $150–$600 a month for engineers on agentic workflows, $10–$60 for chat-only users. [Request Access →](https://tally.so/r/QKBYVg) [Book a compliance call](https://cal.com/emagliarditi/consus-gateway-intro-discussion) --- title: "Models · Consus" description: "The Consus model catalog: frontier models from OpenAI, Anthropic, Google, and others, each served through a US-only, authorized boundary, with the compliance level of every route." canonical: https://consus.io/models --- Models # Every model. Every boundary. Route to the frontier model your mission needs. Each model is served through a US-only, authorized boundary. The catalog below shows the highest FedRAMP, DoD Impact Level, and ITAR boundary you can route each model through today. Model catalog ## Available today The full catalog, grouped by provider. | Model | FedRAMP Low | FedRAMP Moderate | FedRAMP High | DoD Impact Level IL2 | DoD Impact Level IL4 | DoD Impact Level IL5 | ITAR | | --- | --- | --- | --- | --- | --- | --- | --- | | Anthropic | | Claude Opus 5.5 | Available | Available | Available | Not available | Not available | Not available | Available | | Claude Sonnet 5.5 | Available | Available | Available | Not available | Not available | Not available | Available | | Claude Haiku 5.5 | Available | Available | Available | Not available | Not available | Not available | Available | | Claude Opus 5 | Available | Available | Available | Available | Not available | Not available | Available | | Claude Sonnet 5 | Available | Available | Available | Available | Available | Available | Available | | Claude Opus 4.8 | Available | Available | Available | Available | Not available | Not available | Available | | Claude Opus 4.7 | Available | Available | Available | Available | Not available | Not available | Not available | | Claude Opus 4.6 | Available | Available | Available | Available | Not available | Not available | Not available | | Claude Sonnet 4.6 | Available | Available | Available | Available | Not available | Not available | Not available | | Claude Sonnet 4.5 | Available | Available | Available | Available | Available | Available | Available | | Claude Haiku 4.5 | Available | Available | Available | Available | Not available | Not available | Not available | | OpenAI | | GPT-5.6 Sol | Available | Available | Available | Available | Available | Available | Available | | GPT-5.6 Luna | Available | Available | Available | Available | Available | Available | Available | | GPT-5.6 Terra | Available | Available | Available | Available | Available | Available | Available | | GPT-5.4 | Available | Available | Available | Available | Available | Available | Available | | GPT-5.1 | Available | Available | Available | Available | Available | Available | Available | | GPT-4.1 | Available | Available | Available | Available | Available | Available | Available | | GPT-4.1 Mini | Available | Available | Available | Available | Available | Available | Available | | GPT OSS 120B | Available | Available | Available | Available | Available | Available | Available | | Google | | Gemini 4 Argon | Available | Available | Available | Available | Available | Not available | Not available | | Gemini 3.8 Flash | Available | Available | Available | Available | Available | Not available | Not available | | Gemini 3.5 Flash | Available | Available | Available | Available | Available | Not available | Not available | | SpaceXAI | | Grok 4.6 | Available | Available | Available | Available | Available | Available | Available | A check means the model can be routed through a boundary at that tier. Models themselves are not certified. ## Don't see the model you need? We add models as our upstream providers authorize them. Tell us if you are looking for something specific. [Request Access →](https://tally.so/r/QKBYVg) [Book a compliance call](https://cal.com/emagliarditi/consus-gateway-intro-discussion) --- title: "Compliance · Consus" description: "Consus compliance posture: FedRAMP Equivalent, assessed against all 410 FedRAMP High controls, ITAR support, US persons only, zero data retention, and the evidence you hand your CMMC assessor." canonical: https://consus.io/compliance --- Compliance · As of October 2026 # Designed for security and compliance on day one We run a US-person-only, zero-data-retention AI gateway on FedRAMP High and DoD IL5 authorized cloud infrastructure. Consus is FedRAMP Equivalent, assessed by our 3PAO against all 410 FedRAMP High controls, and supports ITAR workloads. The body of evidence your CMMC assessor will ask for is available under NDA. Top Level Compliance Summary Active Zero Data Retention Prompts and completions never persist Nothing you send through Consus is stored, by us or by the model provider. Zero data retention is in place with every upstream model provider, and only operational metadata (model, tokens, timestamps) is logged. Active ITAR Compliant Export-controlled by design The controls ITAR requires are built into how Consus runs: US persons only in the data plane (120.54(a)(5)), US-only cloud regions, and access that is logged and reviewed. Customers remain the registered exporter for their technical data. Active FedRAMP Equivalent Assessed at the FedRAMP High baseline DFARS [252.204-7012](https://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm#:~:text=D,-\)%C2%A0%20If%20the%20Contractor) requires any cloud that handles your CUI to meet FedRAMP Moderate or its equivalent ([DoD memo](https://dodcio.defense.gov/Portals/0/Documents/Library/FEDRAMP-EquivalencyCloudServiceProviders.pdf)). Although only Moderate is required, we worked with our 3PAO and assessed all 410 FedRAMP **High** controls. The body of evidence for your CMMC assessor is available under NDA. Frameworks ## What we claim and what backs it FedRAMP Equivalency DFARS 252.204-7012(b)(2)(ii)(D) Completed Under DFARS 7012, any cloud that handles your CUI must meet the FedRAMP Moderate baseline or its equivalent, and your CMMC assessor will check. If you integrate the cloud yourself, that equivalency audit is yours to run. Required of Consus 100 percent compliance with all 323 Moderate baseline controls, assessed by a FedRAMP-recognized 3PAO and documented in a body of evidence. Consus went further: our 3PAO assessed all 410 FedRAMP High controls. The body of evidence goes straight into your CMMC package. ITAR (22 CFR 120-130) 22 CFR 120.54(a)(5) Satisfied ITAR controls the export of defense technical data, and foreign-person access counts as a deemed export. The encryption carve-out at 22 CFR 120.54(a)(5) means end-to-end-encrypted data in transit is not an export, and data in transit is not deemed stored in any country it transits. No ITAR certification exists; companies self-certify. Required of Consus US persons only in the data plane, US-only cloud regions, end-to-end encryption in transit with FIPS 140 validated modules, and no persistence of customer technical data. You stay the registered exporter for your technical data. DoD Impact Level 5 DoD CC SRG IL5 Roadmap DoD Impact Levels classify how sensitive the data a cloud may host is. IL5 covers higher-sensitivity CUI and unclassified national security systems, and the authorization attaches to the cloud and IaaS layer. Required of Consus A Consus-specific IL5 authorization is on the roadmap, not in place today. What is in place now: Consus runs entirely on infrastructure that already holds IL5 P-ATO across AWS GovCloud, Azure Government, and GCP Assured Workloads, so the IL5 controls are inherited at the IaaS layer. The application-layer authorization is future work. SOC 2 Type II AICPA SOC 2 Completed SOC 2 is an independent AICPA attestation on a service organization's security controls. A Type II report covers how those controls operated over an observation window, not just at a single point in time. Required of Consus Complete an audit by an AICPA-accredited firm. Consus has completed its SOC 2 Type II audit, and the report is available under NDA. Vanta runs continuous control monitoring. CMMC Level 2 NIST SP 800-171 Support role CMMC is the DoD's certification that Defense Industrial Base contractors protect FCI and CUI, with Level 2 mapped to NIST 800-171. The certification applies to contractors, not to the cloud providers they use. Required of Consus Not a certification Consus holds. Consus supports your Level 2 assessment by delivering a FedRAMP equivalency body of evidence, assessed at the High baseline, that you hand to your CMMC 3PAO. Additional Compliance Details ## The controls you can verify The compliance story a program office can defend in one sentence: US soil, US people, validated crypto, zero data retention. Region US-only infrastructure AWS GovCloud, Azure Government, and GCP Assured Workloads. No cross-border replication, ever. Personnel US persons only in the data plane All personnel with production access are US persons per 120.54(a)(5). Access is logged and reviewed. Boundary Three isolated cloud authorizations Each cloud has a separate FedRAMP authorization and a distinct customer-managed key. No shared key material across boundaries. Crypto FIPS 140 validated end to end TLS 1.2+ in transit, AES-256 at rest, all on CMVP-validated modules. Cert numbers available in the evidence package. Identity No long-lived service account keys Federated cloud access with ephemeral, short-lived credentials. Static-key creation blocked by organization policy. Retention Zero persistence of prompts or completions Sanitized at every log boundary. Only operational metadata is retained — model, tokens, timestamps, routing decisions. Shared responsibility ## Who owns which control A provider-level split of the 800-171 families most programs ask about. The per-control mapping is in the workbook we send under NDA. Consus Customer | Control area | What we do | What you do | | --- | --- | --- | | Identity & access800-171 3.1 · 3.5 | ConsusAPI key authentication with per-key scoping. Policy headers enforce program, classification, and contract pinning per request. Gateway-side key rotation on schedule or on request. | CustomerIssue and rotate your API keys. Scope keys to programs. Revoke on offboarding. Enforce your own IdP for the humans behind the keys. | | Encryption800-171 3.13 | ConsusTLS 1.2+ in transit, AES-256 at rest on FIPS 140 validated modules. Distinct customer-managed keys per cloud boundary. No shared key material. | CustomerProtect your API keys in your own secret store. Rotate on schedule. | | Audit logging800-171 3.3 | ConsusEvery request is logged: model, provider, timestamp, token counts, and provider routing decision. Prompts and completions are not logged. Logs are encrypted under a customer-managed key, retained for 365 days, and available on request under NDA. | CustomerLog prompts and completions on your side if required. Define what you need for your own compliance program. Request exports during audits or IR. | | Personnel security800-171 3.9 | ConsusData plane personnel are US persons per 120.54(a)(5). Access reviews documented. Access logged. | CustomerVet and clear your own end users. Decide who in your org gets API keys and at what scope. | | Incident response800-171 3.6 · DFARS 7012 | ConsusDetection and containment at the gateway layer. Customer notification within 24 hours of a confirmed incident. DoD CIO notification within 72 hours via dibnet.dod.mil per DFARS 252.204-7012. Relevant logs preserved and shared under NDA. | CustomerRun your own IR program. Notify Consus of incidents on your side that may affect gateway traffic. Remediate your systems and users. | | Vulnerability management800-171 3.11 | ConsusContinuous vulnerability monitoring. SLA-driven remediation: 30 days for Critical and High, 90 for Moderate, 180 for Low. | CustomerMaintain your own vulnerability program for the systems calling our API. | | CUI handling800-171 3.8 | ConsusStateless pass-through. No request or response content is cached, stored, or made available to other users. Responses go directly to the authenticated caller. | CustomerClassify your own data. Select the appropriate provider and model for the classification of each request. Define what counts as CUI within your program scope. | | Data boundaryITAR | ConsusUS-only cloud regions. No cross-border replication. US persons only in the data plane. | CustomerKeep controlled data within the agreed boundary. Notify Consus of scope changes that affect classification or routing. | Body of Evidence ## What you hand to your CMMC 3PAO ### System Security Plan (SSP) Full SSP and associated Appendices including User Guide, Digital Identity Worksheet, Rules of Behavior, and more. PDF ### Security Assessment Plan (SAP) Security Test Case procedures & Penetration Test plan & results. PDF ### Security Assessment Report (SAR) 3PAO generated deliverables including: Risk Exposure Table, Penetration Test Reports, Infrastructure Scans, & Web Scans. PDF ### Plan of Action and Milestones (POA&M) Current POA&M, Continuous Monitoring Strategy, and Continuous Monitoring Monthly Executive Summary. Exported on request Also available on request: internal vulnerability scan reports, dependency inventories, and AI-driven penetration test results. These are not formal audit artifacts — we share them because they're useful for a technical review. ## Send this to your ISSO. We'll set up an NDA and walk your compliance team through the evidence packet on a working call. No marketing slides. [Book a compliance call →](https://cal.com/emagliarditi/consus-gateway-intro-discussion) --- title: "Frameworks · Consus" description: "A plain-English guide to FedRAMP, DoD Impact Levels, and ITAR, the three compliance frameworks defense cloud customers confuse, plus the CUI label that sits across them." canonical: https://consus.io/frameworks --- Defense Cloud Compliance Frameworks # Three Regimes _Three Axes_ A plain-English guide to **FedRAMP**, **DoD Impact Level**, and **ITAR**. The three compliance frameworks defense cloud customers keep confusing for each other, plus the **CUI** label that sits across all of them. The mental model in one paragraph Imagine a nightclub. _FedRAMP_ is the health inspector's certificate on the wall. The government won't enter a building without it. _DoD Impact Level_ is the velvet-rope system inside. Different VIP rooms for different levels of sensitive conversation. _ITAR_ is the bouncer at the door checking passports. Some rooms only US persons can enter, no matter what level. And _CUI_ is a label stamped on the documents people bring in. It tells everyone which rooms those documents are allowed in. Section 01 · The cast of characters ## Four things that _are not the same_ FedRAMP Federal cloud authorization “Is this cloud safe enough for a federal agency to use at all?” Who runs it GSA / FedRAMP PMO Applies to Any cloud service selling to federal agencies Levels Low · Moderate · High What's being rated The cloud provider itself DoD Impact Level Dept. of Defense cloud only “How sensitive is the military data we're putting on this cloud?” Who runs it DISA (DoD) Applies to DoD workloads on commercial cloud Levels IL2 · IL4 · IL5 · IL6 What's being rated The cloud plus the data sensitivity ITAR Export control · State Dept “Can a non-American legally be allowed to see this?” Who runs it DDTC (State Dept) Applies to Defense articles and technical data (USML) Levels None. You either handle it or you don't What's being rated Your people, processes, and physical/logical access CUI A data label, not a regime “This document is sensitive but not classified. Protect it accordingly.” Who owns the label NARA CUI Program What it actually is A classification marker stamped on sensitive-but-unclassified data Levels None. Data is either CUI or it isn't Governs how? Via CMMC / NIST 800-171 for contractors (see column four) Section 02 · The right mental picture ## Compliance is an _axis_, not a single line DoD sensitivity → IL2 IL4 IL5 IL6 Non-ITAR ITAR **Public agency website**Low sensitivity, no export control. Plain FedRAMP Moderate covers it. **Defense program mgmt data**Mission-critical CUI on a DoD system, but not on the USML. IL5, no ITAR needed. **Commercial aerospace tech**USML-controlled but no DoD contract. ITAR applies. DoD IL does not. **Spacecraft data on DoD contract**Both worlds. IL5 _and_ ITAR required, stacked. Export control → ### Any given workload sits at a _point_ on this plane, not at a rank on a single ladder. The vertical axis is DoD's framework (data sensitivity). The horizontal axis is the State Department's framework (export control). **A workload can be high on one and low on the other**, or high on both, or low on both. This is why saying "IL5 is higher than ITAR" is a category error. It's like asking whether a driver's license is higher than a passport. Section 03 · The actual differences ## Side by side, _in one table_ | | FedRAMP | DoD IL | ITAR | CMMC / NIST 800-171 | | --- | --- | --- | --- | --- | | Legal basis | FISMA & OMB policy_Executive branch_ | DoD Cloud Computing SRG_DoD instruction_ | 22 CFR 120–130_Federal regulation_ | DFARS 252.204-7012 / -7019 / -7020 / -7021 & 32 CFR 170_CUI + assessment + CMMC clauses_ | | Agency | GSA · FedRAMP PMO | DISA | State Dept · DDTC | DoD CIO · OUSD(A&S) | | What it protects | Federal government data on commercial cloud | DoD-specific sensitive data, tiered by impact | Defense articles and technical data (US Munitions List) | Contractor systems that handle CUI data | | Tiers / levels | Low · Moderate · High | IL2 · IL4 · IL5 · IL6 | None. You meet it or you don't | CMMC Level 1 · 2 · 3 | | How you get it | 3PAO assessment → agency ATO_Months to years · expensive_ | DISA Provisional Authorization, usually inherits FedRAMP_Months · heavy paperwork_ | DDTC registration + export-controls program_Self-attested · audited if challenged_ | Self-attestation (L1) · C3PAO assessment (L2) · DoD assessment (L3)_Phase 1 enforcement began Nov 2025 · C3PAO L2 mandatory Nov 2026_ | | US persons required? | Varies by ATO | Yes. IL4+ | Yes. Strict | Contract-dependent (usually yes) | | Data residency | US (Moderate/High) | US | US (strict) | US (typical) | | Rated subject | The cloud provider | Provider + workload | The handling organization | The contractor's systems | | Who pays | Cloud vendor | Mostly the cloud vendor | The data handler | The contractor | | Common mistake | Assuming “Moderate” covers DoD workloads. It doesn't. | Thinking IL5 subsumes ITAR. It doesn't. | Treating ITAR as “just IL5 plus.” It isn't. | Confusing the CMMC regime with the CUI label it protects. | Section 04 · Which one do you actually need? ## Real scenarios, _matched to the right regime_ 01 Commercial satellite company designing a new bus. No DoD contract. Spacecraft engineering data is on the USML. ITAR No DoD IL required Pure export-control problem. ITAR Assured Workloads is the right home. IL5 is overkill and doesn't apply. 02 DoD contractor handling personnel records for a base. Sensitive CUI. Not technical, not export-controlled. DoD IL4 or IL5 CMMC L2 DoD CUI without ITAR. Needs IL-authorized cloud plus CMMC L2 on the contractor's side. ITAR isn't involved. 03 Prime contractor on a DoD spacecraft program. Technical data that is both USML-controlled and DoD CUI. DoD IL5 ITAR CMMC L2 The full stack. Both regimes apply simultaneously plus CMMC on the contractor's posture. This is where most prime-contractor workloads land. 04 Federal agency wanting to use a new SaaS tool. Not DoD. Standard civilian agency use case. FedRAMP Moderate Plain civilian cloud authorization. No DoD IL, no ITAR, no CUI label unless the specific workload introduces one. 05 Startup selling to aerospace primes but no contract yet. Pre-sales demos. No regulated data exchanged yet, but it's coming. CMMC L2 (readiness) ITAR (readiness) Primes flow down DFARS clauses when contracts land. Stand up CMMC and ITAR posture now. Working backwards from a signed deal is painful. FedRAMP isn't relevant here; that's for selling to federal agencies directly. 06 Intelligence community workload with classified elements. Above CUI. Actually classified. IL6 IL6 is for classified up to SECRET on dedicated infrastructure. Totally different operating model. Not a casual add-on. Section 05 · Things people keep getting wrong ## Compliance myths, _busted_ “IL5 is higher than ITAR, so IL5 includes ITAR.” Actually Two agencies, two regulations, two separate authorizations. **IL5 gives you no ITAR cover, and ITAR compliance doesn't satisfy any DoD IL.** They're orthogonal axes from DoD and the State Department respectively. “FedRAMP High is basically IL5.” Actually FedRAMP High is a **prerequisite** for IL5, not a substitute. DoD inherits from FedRAMP and layers its own requirements on top (personnel, US-only, specific encryption, DISA PA). “CUI is just another DoD impact level.” Actually CUI is a **label on data**, created by a NARA program for the whole government, not just DoD. The _regime_ that governs how contractors handle CUI is **CMMC / NIST 800-171**. A separate thing from the label itself, and separate again from the cloud tier the data lives on. Appendix · Acronym decoder ## Helpful acronyms 3PAO Third-Party Assessment Organization. The FedRAMP-accredited auditor that assesses a cloud against FedRAMP controls. ATO Authority to Operate. The paper that says “yes, you can run this system.” C3PAO Certified Third-Party Assessor Organization. The auditor that assesses CMMC compliance. CC SRG DoD Cloud Computing Security Requirements Guide. Defines the IL tiers. CMMC Cybersecurity Maturity Model Certification. DoD's framework for contractor CUI handling. CUI Controlled Unclassified Information. Sensitive but not classified. DDTC Directorate of Defense Trade Controls. The State Department office that runs ITAR. DFARS Defense Federal Acquisition Regulation Supplement. DoD's contract clauses. -7012 is the CUI safeguarding clause; -7019 and -7020 cover NIST 800-171 self-assessment and SPRS reporting; -7021 is the CMMC certification clause. DISA Defense Information Systems Agency. Grants IL provisional authorizations. FedRAMP Federal Risk and Authorization Management Program. The government-wide cloud authorization program. DoD inherits from FedRAMP and layers IL requirements on top. FISMA Federal Information Security Modernization Act. The statute that gives FedRAMP its legal teeth. IL Impact Level. DoD's data-sensitivity scale for cloud hosting (2, 4, 5, 6). ITAR International Traffic in Arms Regulations. Export control on defense articles and technical data. JAB Joint Authorization Board. The legacy top-tier FedRAMP authorizer. Sunset in 2024. The current path is agency ATO only. NARA National Archives and Records Administration. Runs the government-wide CUI program that defines the label. NIST 800-171 The control framework for protecting CUI on non-federal systems. 110 controls. PA Provisional Authorization. DISA's stamp that a cloud can host a given IL. SRG Security Requirements Guide. DoD's document defining IL tiers. USML United States Munitions List. The catalog of items that are export-controlled under ITAR. Not legal advice. Consult counsel for specifics. --- title: "Authorized cloud ≠ compliant use · Consus" description: "Why connecting to AWS GovCloud or Azure Government doesn't make your AI use compliant, what direct integration leaves you to build, and how Consus closes the gap." canonical: https://consus.io/compare --- Why Consus # “We connected to AWS GovCloud, ~so we’re compliant~.” Wrong. Their own paperwork says so. FedRAMP authorization covers the **platform**, not your use of it. Each CSP publishes a Customer Responsibility Matrix that rules, control by control, on what customers actually inherit. We tallied every row of all three: AWS GovCloud 11% 11% 89% Azure Government 10% 10% 90% Google Cloud 19% 19% 81% **At best, 1 in 5, and that slice is mostly the building:** badge readers, HVAC, disk shredders. The rest you build, document, and defend in your CMMC assessment. Or you route through Consus: it’s configured on day one, and our 3PAO has already assessed it against all 410 FedRAMP High controls. The control gap ## What direct integration leaves you: _a six-figure compliance project_ Every ✗ below is a NIST 800-53 / CMMC 2.0 control you implement, document, and defend in your CMMC assessment. Every ✓ ships configured through the Consus Gateway. | Control | CMMC 2.0 | What it requires | Consus Gateway | AWS Bedrock | Azure Foundry | GCP Enterprise Agent | | --- | --- | --- | --- | --- | --- | --- | | Audit & Accountability | | | | | | AU-2 | 3.3.1 | Log every AI request and response (no prompts or response bodies) invocation logging is off by default | Configured for you | Not configured | Not configured | Not configured | | AU-6 | 3.3.5 | Review and correlate audit records no cross-request review or alerting | Configured for you | Not configured | Not configured | Not configured | | AU-9 | 3.3.8 | Protect audit logs from tampering logs not tamper-protected | Configured for you | Not configured | Not configured | Not configured | | AU-11 | 3.3.1 | Retain audit records (FedRAMP: 1 year) no retention configured by default | Configured for you | Not configured | Not configured | Not configured | | AU-12 | 3.3.1 | Generate a record for every invocation no audit record generated | Configured for you | Not configured | Not configured | Not configured | | Access Control | | | | | | AC-2 | 3.1.1 | Manage the API-consumer account lifecycle no issue / scope / revoke lifecycle | Configured for you | Not configured | Not configured | Not configured | | AC-4 | 3.1.3 | Enforce which models & regions CUI can flow to no model/region allowlisting by default | Configured for you | Not configured | Not configured | Not configured | | AC-7 | 3.1.8 | Detect & throttle brute-force / bad keys none on a raw API key | Configured for you | Not configured | Not configured | Not configured | | Identification & Authentication | | | | | | IA-5 | 3.5.10 | Issue, scope & auto-disable API-consumer credentials no consumer-credential lifecycle | Configured for you | Not configured | Not configured | Not configured | | System & Communications Protection | | | | | | SC-7 | 3.13.1 | Protect the service boundary (WAF) no WAF in front of model calls | Configured for you | Not configured | Not configured | Not configured | | SC-8 | 3.13.8 | Enforce a minimum TLS 1.2 / FIPS cipher floor client TLS/FIPS floor not enforced | Configured for you | Not configured | Not configured | Not configured | | SC-13 | 3.13.11 | Use FIPS-validated cryptography SDKs default to non-FIPS endpoints | Configured for you | Not configured | Not configured | Not configured | | System & Information Integrity | | | | | | SI-4 | 3.14.6 | Monitor traffic for attacks & anomalies AI traffic unmonitored | Configured for you | Not configured | Not configured | Not configured | | Assessment & Continuous Monitoring | | | | | | CA-7 | 3.12.3 | Continuously monitor controls & produce evidence one-time setup, no ongoing evidence | Configured for you | Not configured | Not configured | Not configured | | Incident Response | | | | | | IR-4 | 3.6.1 | Provide an incident-response capability no detection, containment or IR plan | Configured for you | Not configured | Not configured | Not configured | | IR-6 | 3.6.2 | Detect, report & notify on incidents (72-hr DFARS) no notification workflow | Configured for you | Not configured | Not configured | Not configured | Representative subset, not a complete control set. AWS GovCloud, Azure Government, and GCP Assured Workloads are FedRAMP-authorized _platforms_. The gap shown here is the _usage layer_, which the shared-responsibility model leaves to the customer. Every ✓ corresponds to a control executed by Consus. [See full compliance details](/compliance) ## Close the gap with one line of code US-based defense contractors only. Access is granted after a company review and contract. No self-serve. [Request Access →](https://tally.so/r/QKBYVg) [Book a compliance call](https://cal.com/emagliarditi/consus-gateway-intro-discussion) --- title: "ROI Calculator · Consus" description: "What a 49-person ITAR shop spends building a compliant AI gateway itself, compared with Consus Teams. Tokens cost the same either way." canonical: https://consus.io/roi-calculator --- ROI Calculator # Spend months and six figures building ITAR-compliant AI. _Or start using it today._ Building it yourself means a gateway, an ITAR compliance program, and people to run both: $112,500\* in year one before your first token. Consus Teams for a 49\-person shop is $23,520 a year, and you're in production in days. The tokens cost the same either way. ### Year one, itemized Tokens appear on neither side because both paths pay the same raw GovCloud rates. This is what access costs. | | Build it yourself | Consus Gateway | | --- | --- | --- | | Consus Teams subscription | $0 | $23.5K | | Gateway engineering | $37.5K | $0 | | ITAR compliance setup | $75.0K | $0 | | Total cost, year 1 | $112.5K | $23.5K | | Your AI tokens | GovCloud rates | Same | | Time to production | 3 months | Days | | Compliance risk | Your team owns it | Consus owns it | ### Five years of costs DIY ops run every year. The Consus subscription stays flat. | Year | DIY cost | Consus Teams | Annual savings | What the DIY money buys | | --- | --- | --- | --- | --- | | Year 1 | $112.5K | $23.5K | $89.0K | Gateway build + ITAR compliance setup | | Year 2 | $112.5K | $23.5K | $89.0K | Compliance ops + engineering ops | | Year 3 | $112.5K | $23.5K | $89.0K | Compliance ops + engineering ops | | Year 4 | $112.5K | $23.5K | $89.0K | Compliance ops + engineering ops | | Year 5 | $112.5K | $23.5K | $89.0K | Compliance ops + engineering ops | | 5-year total | $562.5K | $117.6K | $444.9K | | 5-year savings with Consus $444,900 Building it yourself runs $562,500 over five years. Consus Teams runs $117,600. Your token spend adds equally to both. **Handling CUI?** Building it yourself costs more: your AI setup goes into your CMMC assessment, which adds about $50,000 up front and a re-audit every three years. Enterprise pricing includes the Body of Evidence for that assessment. [Talk to us →](https://cal.com/emagliarditi/consus-gateway-intro-discussion) ### Where the DIY numbers come from Every assumption is set at the low end of reality. Real programs routinely run higher.
Year-1 engineering (bring-up)$37.5KBuild the gateway and connect the clouds; 1 engineer × 3 months at $150K
Year-1 ITAR compliance setup$75K0.5 FTE × $150K to document controls, restrict access to US persons, and write the technology control plan
Ongoing compliance ops$75K/yr0.5 FTE × $150K, real cost is 0.75–1.0 FTE
Ongoing engineering ops$37.5K/yr0.25 FTE × $150K to run, patch, and update the gateway
Time to production3 monthsAggressive; first builds routinely take longer
## Get to production in days, not months. Consus routes your ITAR workloads on US-only infrastructure from day one. One SDK swap, same OpenAI API you already know. [Request access →](https://tally.so/r/QKBYVg) \*DIY figures are conservative estimates for a 49\-person ITAR shop, based on common defense-tech staffing and vendor rates. Actual costs vary by organization. Consus pricing shown is Teams at $40 per employee per month for 49 employees, the largest Teams size. Companies with 50 or more employees, or any CUI, are on Enterprise. Evaluating ChatGPT Federal or Claude for Government? [Talk to our enterprise team](mailto:sales@consusindustries.co). --- title: "Company · Consus" description: "Consus Industries builds compliant AI products for US defense contractors. Founded 2024, based in San Francisco, built in the United States." canonical: https://consus.io/company --- Company # We build compliant AI products for US defense contractors. Founded 2024. Based in San Francisco. Built in the United States. Backed by Y Combinator Our Thesis ## Own your software. Own your data. For decades, the only way to get software into a defense program was to wait for a vendor to build it, certify it, and sell it back to you. That made sense once. It doesn't anymore. The contractors handling the most sensitive data in the world have had the least say over the software that touches it. Eight figure platforms deployed over three years, used by twelve people. Vendor roadmaps that don't move at the speed of the threat. And underneath all of it, the same problem: no two contractors need the same thing. A hypersonics company doesn't run on a satellite operator's workflows. A shipyard doesn't share a data model with a drone manufacturer. There wasn't an alternative because this industry never had software engineers sitting around to build its own tools. AI changed that. A small team can now ship the application their mission needs in weeks. Own the code. Own the data. Self host the whole thing. The only piece they shouldn't have to build is the AI underneath. Cleared model contracts, a hardened data boundary, US only infrastructure, the evidence trail your assessor wants. That's the same job for every contractor in the country. **We did it so you don't have to.** Consus is the compliant AI layer for ITAR and CUI workloads: FedRAMP Equivalent, assessed at the High baseline, with zero data retention. Your applications stay yours. Your data stays in your boundary. The next decade of defense software won't be written by the next COTS vendor in the certification queue. It will be written by the contractors themselves. We're building the layer that lets them. Founder & CEO ## Eric Magliarditi Before starting Consus, Eric worked on national security missions at SpaceX and supported hypersonic missile development at Castelion. He is building Consus to get state-of-the-art AI into the hands of defense contractors. [LinkedIn →](https://www.linkedin.com/in/ericmagliarditi/) Procurement ## Who you are contracting with.
Legal entityConsus Industries, Inc.
HeadquartersSan Francisco, California
CAGE code1ASB6
SAM.govRegistered
SPRS score101, assessed April 2026
# "Just put the gateway in your own tenant" is the wrong fix October 15, 2026 · Eric Magliarditi Canonical: https://consus.io/blog/gateway-in-your-own-tenant-is-the-wrong-fix > Deploying an AI gateway into your own government cloud tenant makes your CMMC boundary bigger, not smaller. Here is why, and when it is still the right call. There is a pitch going around the defense industrial base that sounds great in a demo. It goes like this: don't send your CUI through someone else's gateway. We'll deploy a gateway into your own Azure Government, AWS GovCloud, or GCP Assured Workloads account. Your boundary stays exactly where it is. Tokens at cost. One line of code. I spent years at SpaceX and Castelion on the receiving end of compliance architecture, and I now run a company whose entire product is routing AI inference for contractors handling CUI and ITAR data. I want to explain why "a gateway in your tenant" is a worse deal than it looks, and when it is actually the right call. ## The boundary does not stay unchanged. It grows. The core claim is that deploying into your tenant keeps your assessment boundary untouched. The opposite is true. Every resource a vendor stands up inside your account is yours the moment it is created. The compute. The networking. The key vault. The log sink. The identity federation. The patch cadence. At your CMMC Level 2 assessment, nobody asks who originally clicked the buttons. They ask who operates it, who reviews the logs, who rotates the keys, who responds when something breaks at 2am, and where that is written down in your SSP. A "hardened environment configured before the first request" is a snapshot. Compliance is not a snapshot. It is 110 practices you have to keep doing. If the gateway runs in your tenant, you are the system owner for every one of those practices as they apply to it. The vendor's evidence package tells your assessor what the configuration looked like on day one. It does not tell them who has been maintaining it since. Compare that to Consus. Your prompt goes in, the response comes back, and your prompts and completions are never written to disk, logs, or any store along the way. We keep only operational metadata (model, tokens, timestamps, routing decision), which is the audit trail your assessor wants to see. Consus still goes into your SSP, as an external service provider with its own body of evidence. What it does not add is infrastructure you operate, because there is no new infrastructure in your account. ## "Every model your cloud offers" means one cloud, one vendor This is the part the diagram leaves out. Claude is not on Azure Government. OpenAI's frontier GPT models are not on AWS GovCloud. Gemini is only on GCP, and Vertex generative serving is not inside the ITAR scope of Assured Workloads at all. If you want Claude and GPT for your engineers, and you want them on authorized infrastructure, you need at least two government clouds. Three if you want Gemini for non-ITAR work. "Deploy into your tenant" quietly becomes "deploy into your tenants." Each one needs its own account, its own authorization, its own model enablement (Bedrock model access in GovCloud and Azure OpenAI approval in Azure Government are both separate requests with their own timelines), its own key management, and its own logging. That is three environments you now operate, and the gateway in each of them is yours. Consus runs those three clouds so you don't have to. One API key reaches Claude on Bedrock GovCloud, GPT on Azure Government, and Gemini on Vertex in Assured Workloads. The compliance level is in the model ID. `claude-sonnet-4-5:itar` goes to an ITAR-authorized path and nowhere else. A request with no compliance level is rejected. The multi-cloud engineering is the product. That is not a markup; it is the thing you are buying. ## Most small contractors do not have a government cloud account If you have 30 engineers and a DFARS 7012 clause, there is a decent chance you do not currently have an Azure Government subscription or a GovCloud account. Getting one is not instant. Microsoft screens Azure Government customers. AWS GovCloud requires an existing commercial account and its own vetting. Then you need the Bedrock or Azure OpenAI enablement on top. Realistically that is weeks, and for some teams it is months. The "one line of code" in the in-your-tenant pitch is the last line. Everything that comes before it is on you. With Consus, access is typically approved within 24 hours, you change one base URL, and you are running real requests through a compliant path the same day. Your compliance team reviews our architecture and evidence in parallel. Nobody waits on a cloud onboarding queue. ## "Tokens at cost" has three cloud bills attached Tokens at cost is a fine principle, and we do it too. Both models also charge a platform fee on top of the tokens. The difference is what sits next to that fee. In your own tenant, you are also paying for provisioned throughput on Azure OpenAI, Bedrock capacity on GovCloud, and Vertex on GCP. That is three cloud bills, three sets of reserved capacity decisions, and three sets of idle-capacity risk, plus the engineering time to keep all of it running. With Consus, the platform fee and the tokens are the whole bill. The honest way to compare cost is total cost under the same workload assumptions: volume, required models, compliance levels, retention, staffing, and evidence obligations. For a small team, the labor line dominates the token line every time. ## Who gets admin access to your government tenant? To deploy a gateway into your tenant, the vendor usually needs privileged access to your tenant, unless your own team runs their deployment. Someone from outside your company is creating resources, configuring identity, and setting up key management inside the environment that holds your CUI. That is not disqualifying, but it is an access-control question your assessor will ask, and you need a good answer. Who at the vendor had access? For how long? Was it revoked? What did they touch? Is any of it still running under a service principal they created? Consus needs zero access to your tenant. You get an API key. We never see your cloud. ## "ITAR by design" is not a region setting ITAR is an export control regime. It is about who can access technical data, not just where the server sits. A US region is a good start, but it does not make a system ITAR-compliant on its own. The question is whether a foreign person could get at your unencrypted technical data anywhere in the path, and whether you can show that they could not. We answer it the conservative way: US-only regions, US persons only in the data plane, FIPS 140 validated encryption end to end, and no prompts or completions stored. Consus routes ITAR-tagged requests only to providers with an ITAR-authorized path (today that is Bedrock in AWS GovCloud and Azure OpenAI in Azure Government; Gemini is not offered for ITAR because it does not qualify). We do not treat "US region" as the finish line, and you should not accept a pitch that does. ## The question you should ask us, and anyone else Here is the strongest argument for the in-your-tenant model, and I am going to make it for them because you should hear it. If a third party processes your CUI, that third party is an external service provider under the CMMC rule, and it needs FedRAMP Moderate authorization or equivalency. "Zero persistence" is a good architecture, but it does not by itself get anyone out of that requirement. A gateway that cannot show you FedRAMP Moderate equivalency is asking you to extend your boundary to an unassessed system. So ask. Consus is FedRAMP Equivalent: in October 2026 a 3PAO assessed us against all 410 FedRAMP High controls, well past the Moderate baseline the rule requires. We also hold a SOC 2 Type II, and submits an SPRS score of its own. Our SSP, POA&M, and architecture documentation are available to your assessor. If whoever you are evaluating cannot show you that, the in-your-tenant pitch is right about them. It is not right about us. ## When deploying into your own tenant is actually correct I don't think the model is dumb for everyone. It is correct when: - Your workload needs one vendor's models and you are fine never using the others. - Your contract or program office explicitly requires inference to run in infrastructure you control. Some do. If yours does, the decision is made for you. In that case the gateway in your tenant is a small addition to a system you already own. Go do it. For everyone else, which in my experience is most contractors under a few hundred people, you are being offered a compliance project dressed up as a product. ## What the split looks like with Consus Consus is a routing layer. We guarantee your request goes to the right provider, at the right compliance level, through authorized infrastructure, without persisting your prompts or completions along the way. We handle routing, isolation, encryption, FIPS endpoints, key management, and the provider-side evidence. We also enforce where requests are allowed to go. You set an org-wide ceiling by compliance level or by model, map your identity provider's groups to policies, and no key can call anything outside them. A key capped at ITAR cannot reach a non-ITAR model, whatever the user sends. What we do not do is read prompt content. Data classification and DLP stay in your own application layer, where your assessor expects to find them. That is a deliberate line, and it keeps your assessment story simple. ## Try it before you believe any of this Request a key. Once it is approved, point your OpenAI or Anthropic client at `api.consus.io` and run a real request through an ITAR path in five minutes. Then hand our evidence package to your assessor and ask them which architecture they would rather sign off on. [Book an intro call](https://cal.com/emagliarditi/consus-gateway-intro-discussion). # US-Only AI Models and CMMC Compliance for Defense Contractors October 6, 2026 · Eric Magliarditi Canonical: https://consus.io/blog/us-only-ai-models-and-cmmc-compliance-for-defense-contractors > What "US-only" actually means for an AI model, and how defense contractors can prove it to a CMMC assessor. ## Consus Gives You a US-Only Boundary With an Integration Layer You Already Know Defense contractors need to keep existing AI applications working while preventing controlled information from reaching an unapproved environment. Consus solves both halves of that problem at once: it speaks the OpenAI-compatible API your applications already use, and it enforces a US-only, government-cloud routing boundary underneath it, so switching to a compliant path means changing a base URL, not rebuilding your application. To be clear about what that does and doesn't mean: compatibility alone does not establish CMMC or ITAR compliance, and Consus doesn't claim otherwise. The contractor still needs to assess hosting geography, personnel and subprocessor access, authentication, encryption, retention and model-training terms, incident handling, contract requirements, the complete data flow, and the CMMC assessment boundary. What Consus does is remove the hardest, most error-prone piece of that work, the routing and infrastructure layer, and hand you documented evidence for it instead of leaving you to build and prove it yourself. Consus supports existing OpenAI-compatible clients without requiring customers to replace their application layer ([security architecture][security-architecture]; [integrations overview][overview]), including clients built with the OpenAI SDK, LangChain, LlamaIndex, LiteLLM, Cline, and OpenCode. US-only routing is a meaningful boundary control because it constrains where requests travel. It is not a certification, a data-classification decision, or a substitute for the contractor's documented controls and assessed system scope. Consus is explicit about that split of responsibility rather than blurring it. ## Define the Data and Assessment Boundary Before Selecting a Model A model decision starts with the information that can enter, leave, or support an AI request. The review must cover more than the prompt. Attachments, retrieval results, outputs, application logs, model metadata, indexes, backups, and administrative services can all affect the system boundary. AI used to process, store, or transmit CUI requires cloud-use analysis. The Cloud Security Alliance guidance explains that CMMC requirements do not explicitly mention AI, while [DFARS 252.204-7012][dfars-7012] requires external cloud services that handle covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline ([Cloud Security Alliance][csa-cmmc-ai]). Treat an API, gateway, client-side retrieval component, vector store, logging system, and administrative plane as components to evaluate when they process, store, or transmit CUI. Documenting those flows allows the contractor to define a defensible assessment boundary. Because Consus keeps no prompt or response content, the gateway hop itself is one of the shortest, easiest components in that boundary to document. CUI or ITAR-controlled technical data should not go to a standard commercial endpoint simply because it advertises U.S. residency or uses an OpenAI-compatible interface. Approval requires review of the complete flow, authorization conditions, contract terms, access model, and the contractor's assessment boundary. The same Cloud Security Alliance guidance advises against consumer and public AI tools for CUI or FCI. That is exactly the category Consus is built to keep you out of, since there is no configuration path in Consus Gateway to a commercial or non-U.S. region at all. ### Three Questions to Answer Before Any AI Request Ask these questions before the application sends data to a model: 1. What is the classification of the prompt, attachment, retrieval context, and intended output? 2. Where do prompts, outputs, logs, metadata, indexes, and backups travel or persist? 3. Which people, providers, and subcontractors can administer or access each component? These questions should have documented answers for each approved workflow. A prompt that appears harmless can still contain controlled context from a pasted document, retrieved record, file attachment, or system instruction. Consus shortens the second question considerably: for the gateway hop, the answer is "nowhere." Prompts and responses exist only in ephemeral container memory and are never written to disk, logs, or any persistent store. ### When an AI Tool Enters the CMMC Assessment Boundary An AI tool enters boundary analysis when it handles CUI as part of processing, storage, transmission, administration, or supporting operations. The contractor should map the client, gateway, model route, identity provider, retrieval system, logging platform, and management interfaces that support that work. The analysis is a scoping decision, not an automatic declaration that every component is compliant. Each component needs a documented purpose, data-flow position, authorized users, applicable controls, and evidence owner. Consus publishes exactly that documentation for its own layer: architecture, data flow, identity model, and control mapping. A contractor's boundary map can therefore cite a maintained source instead of reverse-engineering one. ## Standard Commercial Endpoints vs. Consus's US-Only Government-Oriented Routing A US-only request boundary addresses where requests remain. It does not classify data, stop an employee from submitting controlled information, create an authorization package, or complete the contractor's CMMC governance and assessment responsibilities. Consus is upfront about this: a routing control is one piece of the picture, and the contractor still owns the rest. Consus keeps every request inside a US-only boundary by design. There is no commercial-cloud routing path to accidentally enable. The contractor remains responsible for deciding which data may use that route and how the system fits within its CMMC boundary, and Consus's documentation is built to make that decision easy rather than opaque. Endpoint settings require close review across the market generally. Residency guarantees vary by provider, project, service, and endpoint setting, and a U.S. region label alone does not say which data the guarantee covers. That is exactly the kind of scoping question Consus removes, since every model behind Consus routes through a single documented government-cloud boundary regardless of which model maker built it. | Decision factor | Standard commercial AI endpoint | Consus's US-only government-oriented routing | What the contractor must verify | |---|---|---|---| | Processing and storage geography | May vary by provider, project, service, and endpoint setting | Every request stays within AWS GovCloud, GCP Assured Workloads, or Azure Government, and no commercial-region path exists | Confirm the route matches the workload (Consus's [model catalog][model-catalog] states this per model) | | Personnel and subprocessor access | Provider terms and access practices vary | Workload Identity Federation with no static cloud credentials at rest; access scoped per cloud | Administrative access, support access, and subprocessor terms for the selected cloud | | CUI and ITAR workload support | Not established by API compatibility or U.S. residency alone | Model IDs carry FedRAMP/IL/ITAR authorization directly (`:il5+itar`, `:fedramp-high`, `:itar`) | Authorization conditions, contract support, and workload eligibility for the specific model | | Retention and model-training terms | Vary by service and configuration | Zero-persistence architecture; Consus does not sell, advertise with, or train on customer data | Retention setting and configuration evidence for the selected route | | Prompt, output, and metadata logging | Service logs may have separate handling rules | Billing metadata only (API key ID, model name, token counts, latency), never prompt or response content | What is logged, where it persists, who can access it | | Model availability and routing | Provider-selected models and regions can vary | 20+ models from Anthropic, OpenAI, Google, and xAI, each with a documented authorization ceiling | Approved model ID, route designation, and change controls | | CMMC assessment responsibility | The contractor owns its system assessment | The contractor still owns its system assessment. Consus supplies SSP and POA&M evidence for the gateway layer | SSP scope, POA&M items, inherited controls, evidence, and operational procedures | Provider environment evidence can support a contractor's decision. It does not replace the contractor's responsibility to assess the combined application, users, data, tools, and operational controls. Still, starting from Consus's documented environment evidence, instead of building that evidence from scratch, is most of the difference between a months-long integration and a same-day one. ## Choose a US-Boundary Model Route That Matches the Data Classification Data classification and the required authorization determine the route selection. A team should select a route deliberately for the workload rather than treating all environments as interchangeable. Consus enforces this by construction: it requires users to choose the compliance level required by their data classification and authorization, and its configuration rules prohibit mixing compliance levels in one `models.json` file ([Pi integration guide][pi-integration]), so a misconfiguration that quietly blends compliance tiers is rejected rather than silently allowed. ### Government Cloud Deployment Paths: All Included, One API Key Consus routes to three government-oriented deployment paths, each with clearly documented coverage, all reachable through a single `CONSUS_API_KEY`: - **Azure Government Azure OpenAI Service** supports GPT-4.1, GPT-4.1 Mini, GPT-5.1, and GPT-5.6 Sol, with FedRAMP High, DoW IL5, and ITAR coverage. - **AWS GovCloud and Amazon Bedrock** serve Claude, OpenAI GPT-OSS, OpenAI GPT-5, and xAI Grok 4.6 models, with FedRAMP High, DoW IL5, and ITAR coverage for applicable workloads. - **GCP Assured Workloads with Vertex AI** supports Gemini and Claude models for FedRAMP High, FedRAMP Moderate, and FedRAMP Low requests. This path is the right choice for CUI-level workloads that don't require ITAR or DoW IL5. Consus routes there automatically for eligible models rather than making you provision a fourth cloud environment yourself. | Route or configuration | Underlying environment | Models available through Consus | Stated coverage | Appropriate selection decision | |---|---|---|---|---| | Azure Government Azure OpenAI | Azure Government Azure OpenAI Service | GPT-4.1, GPT-4.1 Mini, GPT-5.1, GPT-5.6 Sol | FedRAMP High, DoW IL5, ITAR | Select when the workload authorization and approved model match this route | | AWS GovCloud Amazon Bedrock | AWS GovCloud and Amazon Bedrock | Claude, OpenAI GPT-OSS, OpenAI GPT-5, xAI Grok 4.6 | FedRAMP High, DoW IL5, ITAR for applicable workloads | Select for approved workloads that require this environment and authorization | | GCP Assured Workloads Vertex AI | GCP Assured Workloads with Vertex AI | Gemini, Claude | FedRAMP High, FedRAMP Moderate, FedRAMP Low | Select for approved requests within the stated FedRAMP coverage | | ITAR-authorized configuration | AWS GovCloud Bedrock and Azure Government Azure OpenAI | Claude Opus 5.5, Claude Opus 5, Claude Opus 4.8, Claude Sonnet 5.5, Claude Sonnet 5, Claude Sonnet 4.5, Claude Haiku 5.5, Grok 4.6, GPT-5.4, GPT-5.6 Terra, GPT-5.6 Luna, GPT OSS 120B, GPT-5.1, GPT-4.1, GPT-4.1 Mini, GPT-5.6 Sol | ITAR authorization | Select only after the contractor approves the ITAR workload, route, users, and controls | This route information comes directly from Consus's security documentation and [model catalog][model-catalog], which stay current as models and authorizations change. The contractor should preserve the selected route and its supporting evidence in its own approval record, citing that source. ### ITAR-Authorized Model Options The ITAR-authorized configuration lists these model options: Claude Opus 5, Claude Opus 5.5, Claude Opus 4.8, Claude Sonnet 5, Claude Sonnet 4.5, Grok 4.6, GPT-5.4, GPT-5.6 Terra, GPT-5.6 Luna, GPT OSS 120B, GPT-5.1, and GPT-5.6 Sol. That is a materially broader ITAR-eligible catalog than most single-cloud integrations offer, because Consus draws from three government clouds instead of one. Model availability does not determine whether a user may submit a specific document. The contractor must first validate the data classification, user authorization, route approval, client configuration, and relevant export-control requirements. ## Apply Controls Across the AI Request Flow Controlled AI use depends on each point where data enters, moves through, or leaves the workflow. The application, gateway, model route, identity service, retrieval layer, and evidence systems should work as one documented process. ### A Controlled Request Flow 1. Classify the prompt, attached files, retrieval context, and intended output. 2. Block, redact, or otherwise prevent unapproved CUI or ITAR data from leaving the approved client or gateway path. 3. Select an explicitly approved US-boundary model route. 4. Authenticate and authorize the request. 5. Record the identity, selected model, data classification, retention setting, routing result, and errors. 6. Preserve records for security operations and assessment evidence. Consus authorizes requests against the selected model ID and routes `:il5+itar` requests to an ITAR-authorized provider in AWS GovCloud Bedrock. Steps 3 and 4 above are enforced server-side, not left to application code to get right. Consus configures model providers for zero data retention where that option is offered, and states in its [privacy practices][privacy] that it does not sell customer data, share it for advertising, or use customer data to train models. Teams still need to verify the terms and settings that apply to their selected provider and route. ### Controls the Gateway Does Not Replace, by Design Consus does not inspect prompt content or response text, classify documents, detect CUI markings, or prevent controlled information from being sent to a model. This is a deliberate design boundary, documented plainly in the [customer-responsibility guidance][customer-responsibility]: the contractor owns client-side classification and prevention controls, and Consus doesn't pretend otherwise or blur that line to look more capable than it is. That clarity is itself valuable. It tells your assessor exactly where the gateway's responsibility ends and yours begins, with nothing left to interpretation. Retention settings, routing controls, and API authentication also do not replace endpoint protection, identity governance, approval workflows, DLP or redaction decisions, secure client configuration, and incident-response procedures. Claude Desktop can use controlled data through the Consus gateway when the contractor approves the route and workflow. The gateway does not control client-side local tool execution, file access, sandboxed shell traffic, or web fetches, so those functions need separate review and controls. ## Implement an OpenAI-Compatible Client Without Rebuilding the Application An OpenAI-compatible API that stays compliant with ITAR and CMMC rules requires more than replacing a base URL. The application needs a policy decision before the request, an approved model allowlist, authenticated gateway access, and logging that supports evidence without exposing controlled content. Consus is built to be the routing and enforcement layer underneath exactly this pattern. ### Illustrative OpenAI-Compatible Configuration, Routed Through Consus ```python import os from openai import OpenAI classification = policy_engine.classify_request( prompt=user_prompt, attachments=selected_files, retrieval_context=retrieved_content, ) allowed_models = { "non_controlled": ["approved-general-model:fedramp-moderate"], "cui": ["approved-cui-model:fedramp-high"], "itar": ["approved-itar-model:il5+itar"], } model_id = policy_engine.select_allowed_model( classification=classification, allowlist=allowed_models, ) client = OpenAI( api_key=os.environ["CONSUS_API_KEY"], base_url="https://api.consus.io/v1", ) response = client.responses.create( model=model_id, input=user_prompt, ) application_logger.info( "ai_request_completed", extra={ "user_id": current_user.id, "classification": classification, "model_id": model_id, "routing_status": "submitted", }, ) ``` The policy layer makes the classification decision before the application sends a request. A model name, gateway base URL, or OpenAI-compatible client does not classify content on its own. That responsibility stays with your application, and Consus does not claim to take it over. The `:il5+itar` pattern must appear only in an approved ITAR route. Consus's documented route behavior authorizes the selected model ID and directs the request to the applicable ITAR-authorized provider environment automatically, with a bare model name (no compliance suffix) rejected outright with a `400` error. There is no default fallback to guess wrong. ### Operational Guardrails for Developers Maintain separate allowlists for each approved classification and environment. Reject a request when its classification does not match a model route, when a user lacks authorization, or when the request includes unapproved attachments or retrieval context. Reject mixed compliance levels in a single `models.json` configuration, because Consus prohibits that configuration outright. Separate configurations reduce the chance that a controlled workload inherits an inappropriate default model or route. Application logs should record operational details needed for auditability, such as identity, classification decision, model ID, route result, timestamp, and error code. Do not log controlled prompt text or output content by default. Consus's own audit logging follows this exact pattern: operational metadata only, retained for up to three years depending on the cloud, with content never captured. ## Set Input Rules for Safe Use Cases and Controlled Data Input rules define how to use generative AI tools without violating CMMC requirements. The decision must account for the entire request, including files, pasted text, tool output, and retrieved context. ### Use Cases That Can Stay Outside the Controlled Boundary A non-controlled workflow can support work that contains no CUI, ITAR-controlled technical data, sensitive attachments, or controlled retrieval context after the contractor's classification process. Examples may include public-source summarization, generic writing assistance, public policy research, and code examples that contain no controlled program information. These examples still require the contractor's normal acceptable-use rules and classification process. ### Inputs That Require an Authorized and Documented Path CUI, ITAR-controlled technical data, controlled drawings, contract-specific technical information, sensitive attachments, and retrieval-augmented prompts that can introduce controlled content require an approved, documented route and boundary controls. Public or consumer AI tools should not become the default destination for those inputs. That is exactly the gap Consus is built to close, giving contractors a documented, compliant destination instead of an improvised one. | Input or use case | Data classification condition | Approved action | Control rationale | |---|---|---|---| | Public or non-controlled work | Contains no CUI, ITAR-controlled technical data, sensitive attachments, or controlled retrieval context after classification | Allow in a non-controlled workflow | Keep the request within the contractor's approved acceptable-use rules | | CUI | Prompt, output, attachment, or context contains CUI | Route through Consus at `:fedramp-high` or `:il4`/`:il5` | The route, cloud use, access controls, and evidence need documented boundary review | | ITAR-controlled technical data | Request contains export-controlled technical data | Route through Consus at `:itar` or `:il5+itar` | Confirm authorized users, approved ITAR configuration, access restrictions, and export-control handling | | Controlled attachments | Files include controlled drawings, program records, or sensitive technical material | Stop for review or route through Consus after approval | Attachments can carry more sensitive data than the visible prompt | | Retrieval context | Retrieval system can insert controlled records into the request | Stop for review or route through Consus after approval | Retrieval components expand the data path beyond the model request | Client-side tools and retrieval systems can expand exposure even when the model request routes correctly. For example, local tool execution, file access, sandboxed shell traffic, and web fetches in Claude Desktop remain outside the gateway's control. ## Preserve Evidence for the SSP, POA&M, and Assessment Process A gateway can provide useful provider evidence, but it does not complete a CMMC assessment. The contractor needs to connect the AI workflow to its existing system security plan, POA&M process, system boundary, control implementation, and assessment artifacts. This is where Consus's evidence program is built to save real time. ### Evidence Checklist Maintain evidence for the following items: - System and data-flow diagrams showing the client, gateway, model route, retrieval components, logs, and administrative interfaces. *(Consus publishes its own architecture and data-flow diagram to build from.)* - An AI component inventory with owners, purposes, environments, and data classifications. - Approved model IDs, route configurations, and configuration-change records. *(Consus's model catalog is a live, maintained version of this.)* - Data-classification rules for prompts, outputs, files, and retrieval context. - Identity and access-control records for users, administrators, service accounts, and approval roles. - Encryption and network-control evidence for data in transit and at rest. *(Consus documents TLS 1.2+, FIPS 140-2 endpoints, and customer-managed KMS keys per cloud.)* - Retention and training settings for the selected provider and route. *(Consus: zero persistence, no training on customer data, documented in writing.)* - Provider and subprocessor review records. - Logging, monitoring, and error-handling records. *(Consus provides audit-ready logging by default, with 365-day to 3-year retention depending on cloud.)* - Incident procedures covering AI-related security events. - Risk findings, remediation actions, and POA&M tracking. - Approvals for controlled use cases and authorized model routes. Consus provides SSP and POA&M evidence for CMMC assessments as part of its compliance program. Incorporate that evidence into the contractor's own SSP, POA&M, system boundary, and assessment artifacts rather than treating it as a replacement. Still, starting from documented vendor evidence rather than a blank page is a meaningful head start on the items above. ### Ownership and Review Cadence Create a decision record for each approved model route. Identify the data classification, environment, authorized users, retention configuration, evidence owner, and approval authority. Review the record when the model, provider, route, client tool, retrieval source, data flow, or applicable contract changes. Assign clear ownership across security, compliance, engineering, program leadership, and export-control functions so that a route does not remain approved after its operating conditions change. The contractor remains accountable for managing the assessment boundary and documenting the controls that govern the complete workflow. ## Build a Defensible Operating Model for Controlled AI, Starting From Consus Classify data before an AI request enters the application flow. Select an authorized route intentionally, keep client and tool activity within the approved boundary, preserve evidence, and review the configuration when the model, provider, data flow, or contract changes. Consus gives defense contractors controlled routing options and integration continuity in a single product: an OpenAI-compatible gateway that keeps existing application patterns in place while enforcing the governance, data controls, and access restrictions required for a US-only boundary. That leaves the contractor to apply data classification, access restrictions, and assessment documentation specific to its own environment, rather than building the routing and infrastructure layer from scratch. US-only hosting alone does not satisfy ITAR or CMMC obligations, and Consus does not market itself as a shortcut around that fact. Compliance depends on the complete documented system and the contractor's operational controls. Consus's job is to make the infrastructure half of that system fast, documented, and defensible, so your team's effort goes into the half only you can own. **Get started:** request access at [consus.io/pricing](https://consus.io/pricing) and follow the five-minute quickstart to route your first request through a compliant, US-only path. ## Frequently Asked Questions ### Does a US-only AI endpoint automatically make an ITAR or CMMC workflow compliant? No. A U.S. boundary addresses where a request travels, while ITAR and CMMC workflows also require data classification, access controls, approved configurations, documented evidence, and an assessed contractor system. Review the full path, including attachments, retrieval systems, logs, and administrative access. Consus is explicit that its routing control is one input to that assessment, not a substitute for it. ### Can I keep using the OpenAI SDK when moving to a controlled AI gateway? Yes. Consus's OpenAI-compatible gateway lets the application keep its existing SDK integration while directing requests through a controlled routing layer. Update the gateway URL to `https://api.consus.io/v1`, swap in your `CONSUS_API_KEY`, set an approved model allowlist, then test that the application rejects requests outside its policy allowlist. ### Can Claude Desktop access ITAR-controlled data safely? Claude Desktop can access ITAR-controlled data through Consus's Claude Desktop integration when the contractor has authorized the workflow and its users. The gateway does not control local tool execution, file access, sandboxed shell traffic, or web fetches, so those client-side functions need separate security review. ### What should I review when a model provider, model ID, or routing configuration changes? Review the data classification, selected environment, user permissions, retention settings, provider terms, subprocessor access, logging behavior, and supporting evidence. Update the route decision record, relevant SSP content, risk records, and approvals before the changed configuration handles controlled data. Consus's [model catalog][model-catalog] is the fastest way to check what changed on the routing side. [security-architecture]: https://gateway.consus.io/security [overview]: https://gateway.consus.io/overview [pi-integration]: https://gateway.consus.io/integrations/pi [customer-responsibility]: https://gateway.consus.io/customer-responsibility [privacy]: https://gateway.consus.io/privacy [csa-cmmc-ai]: https://cloudsecurityalliance.org/blog/2026/01/23/securing-ai-in-cmmc-level-2-environments-a-strategic-guide-for-cisos-and-cloud-security-engineers [dfars-7012]: https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting. [model-catalog]: https://consus.io/models # Secure AI Routing and Gateways for DoW Contracts October 5, 2026 · Eric Magliarditi Canonical: https://consus.io/blog/secure-ai-routing-and-gateways-for-dow-contracts > How defense contractors can route AI requests through a compliant gateway that keeps ITAR, CUI, and CMMC requirements intact on every call. Defense contractors need production AI access without exposing Controlled Unclassified Information (CUI) to public, commercial, or non-U.S. infrastructure. Consus Gateway is built specifically for this problem. It gives defense contractors a controlled, single-API path between their applications and approved government-cloud models, enforcing routing, identity, retention, network, and evidence requirements within the contractor's documented system boundary, without months of in-house cloud integration work. ## What a Secure AI Gateway Must Do for DoW Production Traffic, and How Consus Delivers It An AI gateway is a policy and control layer through which AI traffic passes before reaching an underlying model ([Government Technology Insider][gti-ai-gateway]). It gives applications a unified interface for multiple models while centralizing routing, access control, filtering, and oversight. The gateway, model, and cloud provider have separate roles. The gateway evaluates the request and selects an approved backend. The model processes the request through a specific cloud deployment path. The cloud provider supplies the authorized environment, network controls, location, and supporting services. Consus Gateway occupies that first role, and it is purpose-built for the defense industrial base rather than adapted from a general-purpose product. DoW cloud contracts must include the applicable DFARS Subpart 239.76 cloud policy and contract clauses. They must also use cloud services granted a DoW provisional authorization at the Impact Level appropriate for the workload, per the [DoW Cloud Security Playbook][dow-cloud-playbook]. A production gateway should enforce approved model IDs and compliance tiers, workload identity and least-privilege access, U.S. government-cloud destinations, restrictions on tools and outbound calls, content-retention policy, fail-closed routing, audit records that exclude prompt and response content, and evidence for assessment review. Consus Gateway enforces every item on that list by default, out of the box: - **Approved model IDs and compliance tiers**: every model ID carries its compliance level (`:il5`, `:fedramp-high`, `:itar`); a bare model name with no level is rejected with a `400` error. - **Workload identity and least-privilege access**: Workload Identity Federation to GCP and Azure, with no static cloud credentials at rest. - **U.S. government-cloud destinations only**: AWS GovCloud, GCP Assured Workloads, and Azure Government. There is no configuration path to commercial cloud regions. - **Tool and outbound-call restrictions**: hosted tools (web search, code execution) are rejected at the API layer; tool schemas describing an outbound destination are rejected before they ever reach a model. - **Content-retention policy**: zero-persistence architecture; prompts and responses exist only in ephemeral container memory. - **Fail-closed routing**: an unauthorized model, tier, or route is refused, never silently downgraded. - **Audit records that exclude prompt and response content**: logs carry only API key ID, model name, token counts, and latency. - **Evidence for assessment review**: SSP and POA&M evidence delivered as part of the Consus compliance program. A U.S. cloud region, FedRAMP authorization, or gateway deployment does not establish CMMC compliance by itself. Compliance depends on the full system boundary, the contract requirements, the selected cloud service authorization, and the controls the contractor implements and documents. That is exactly why Consus focuses on handing contractors documented evidence rather than a marketing claim of "compliance." ## The CUI Request Path: From Application to Approved Model and Back, Through Consus The production path should make every routing and authorization decision explicit before CUI reaches a model. Public AI is a blocked lane for CUI. Approved workflows need reviewed environments, approved model lanes, constrained connectors, retention controls, logging, and human review ([GS Consulting][cui-leakage]). Consus Gateway is designed to sit exactly at this chokepoint. The controlled request flow through Consus is: 1. **Client or application** (your existing OpenAI-compatible client, unchanged) 2. **Request classification and identity** (your application layer) 3. **Gateway policy enforcement** (Consus: model ID, compliance tier, tool schema validation) 4. **Authorized model ID and compliance-tier decision** (Consus: bound at the request boundary) 5. **Approved U.S. government-cloud model endpoint** (Consus: AWS GovCloud, GCP Assured Workloads, or Azure Government, router-selected) 6. **Response return** (Consus: zero-persistence, ephemeral memory only) 7. **Audit and billing metadata** (Consus: API key ID, model name, token counts, latency, never content) ### 1. Classify the Request Before It Leaves the Application The application should identify the request's data class and authorized workflow before transmission. Classification should cover prompt text, uploaded files, retrieved documents, system instructions, tool arguments, and any prior conversation included as context. The request should also carry a verifiable workload or user identity. That identity lets the gateway apply policies based on the program, role, data class, approved use case, and destination. If the application cannot determine whether content contains CUI, it should route the request for review or reject it rather than assign a lower classification. Source classification remains necessary even when the gateway runs DLP inspection. Consus does not perform content classification. It is intentionally a routing and boundary-enforcement layer, not a content scanner, so this step stays owned by the application and data owner, who have the mission context needed to classify the information correctly. ### 2. Enforce Policy at the Gateway Boundary, Where Consus Does the Heaviest Lifting The gateway checks the request before it contacts a model. Consus Gateway verifies the caller (via API key), the requested model and compliance tier, and every tool definition, against an approved policy, before the request ever reaches a provider. A request that fails those checks stops at the gateway. Consus does not repair an unauthorized request by silently sending it to a general commercial endpoint or a model with a lower authorization level. A malformed or under-specified model ID is rejected outright, not downgraded. Central enforcement also reduces policy differences between applications. Because Consus Gateway speaks the OpenAI-compatible API, teams get a common interface: the OpenAI SDK, LangChain, LlamaIndex, LiteLLM, Claude Code, Codex CLI, Cline, OpenCode, VS Code Copilot. Consus then applies consistent routing and deny rules across coding assistants, retrieval workflows, document analysis, and other production services. ### 3. Authorize the Model and Compliance Tier A model name alone does not identify an acceptable deployment path. The gateway must bind the requested model ID to a specific provider, cloud environment, compliance tier, and endpoint. Consus Gateway authorizes each request against the selected model ID directly in the ID string. Its routing configuration sends requests marked `:il5+itar` to an ITAR-authorized provider using Amazon Bedrock in AWS GovCloud, `:fedramp-high` to the appropriate FedRAMP High backend, and a bare `:itar` suffix to a model's ITAR-authorized provider without requiring a separate FedRAMP or DoW IL declaration. This is enforced at the API validation layer: a request with no compliance suffix is rejected with a `400` error before it goes anywhere. For teams asking how to keep AI model traffic within U.S. borders for DoW contracts, this is the answer: Consus combines an approved model ID with a documented compliance tier and U.S. government-cloud endpoint in a single request parameter, so there is no unrestricted model alias that can resolve to different providers or regions. Authorization also accounts for the caller's role and program. A model available to one contract or data type may be unavailable to another because the workloads have different Impact Level, export-control, contract, or data-handling requirements. Consus's [model catalog][model-catalog], which records the FedRAMP, DoW Impact Level, and ITAR ceiling for every model and provider pair, makes that distinction explicit rather than leaving it to application-level guesswork. ### 4. Route Only to the Approved U.S. Government-Cloud Backend Consus routes exclusively to government-cloud infrastructure and authorization environments across GCP, AWS, and Azure. There is no commercial-cloud routing configuration to misconfigure. - **GCP Assured Workloads with Vertex AI** serves Gemini models for DoW IL4 requests and Claude models for DoW IL2 requests (FedRAMP High). - **AWS GovCloud and Amazon Bedrock** serve Claude, OpenAI GPT-OSS, OpenAI GPT-5, and xAI Grok 4.6 models. Applicable workloads have FedRAMP High, DoW IL5, and ITAR coverage. - **Azure Government and Azure OpenAI Service** serve GPT-4.1, GPT-4.1 Mini, GPT-5.1, and GPT-5.6 Sol, also with FedRAMP High, DoW IL5, and ITAR coverage. The contractor must still confirm that the selected service, model, cloud path, and authorization match the workload. Availability through a government cloud does not make every model or configuration suitable for every contract. Consus's model catalog lists the authorization ceiling for every model/provider pair so this confirmation is a lookup, not a research project. ### 5. Return the Response Without Persisting Content Consus Gateway processes prompts and model responses entirely in ephemeral container memory. It does not write that content to disk, logs, or any persistent data store. The response returns through the gateway to the calling application. The application then applies its own output controls, including classification, access restrictions, human review, storage policy, and delivery rules. Zero persistence at the gateway does not control downstream storage. The client, retrieval system, observability platform, browser, and destination repository can still retain CUI unless the workflow configures them correctly. Consus removes the gateway itself as a place CUI can pool, which is one fewer system your team has to secure and evidence. ### 6. Retain Evidence Without Retaining Prompt Content Operational evidence should show which identity used an approved route, which model handled the request, and whether policy enforcement succeeded, without copying prompts and responses into general-purpose logs. Consus Gateway retains billing metadata limited to the API key ID, model name, token counts, and latency. Prompt and response content stays outside those billing records entirely. This separation supports investigation and capacity management without creating a large repository of sensitive AI conversations. Contractors should still classify operational metadata and restrict it when model choices, timing, user identities, or workflow patterns could reveal sensitive program information. ## How Consus Keeps Production AI Traffic Inside the U.S. Boundary Keeping AI traffic within U.S. borders requires an allowlist of model IDs, compliance tiers, government-cloud environments, regions, and endpoints. The gateway must deny other destinations and prevent silent fallback to commercial or foreign infrastructure. This is the core design premise of Consus Gateway, not an add-on feature. Geographic location is one part of the decision. Contractors must also evaluate service authorization, identity, network path, retention, model-training settings, logging, encryption, and contract requirements. ### Define the Allowed Destinations Create an inventory that maps each approved model ID to its provider, cloud environment, region, Impact Level, export-control status, endpoint, and permitted data class. Treat an alias or model version change as a routing change that requires review. Consus's [model explorer][model-catalog] already maintains this mapping for every model it serves, filterable by DoW Impact Level, FedRAMP level, ITAR authorization, and model maker, so contractors inherit a maintained inventory rather than building one from scratch. CUI for National Security Systems must use cloud service offerings authorized for IL5 or higher, including appropriate U.S. Government Clouds, matching the workload's Impact Level under the [DoW cloud authorization requirements][dow-cloud-playbook]. DNS names and region labels provide incomplete assurance. Validate the service offering, contract terms, tenant configuration, model deployment, network path, support access, and data-processing commitments. Consus's security documentation publishes this detail per cloud rather than leaving it to be inferred. ### Prevent Fallback to Commercial or Non-U.S. Infrastructure Remove generic provider endpoints from production configuration. Restrict egress so applications can reach the gateway while the gateway can reach only approved backends. There is no configuration in Consus Gateway that routes traffic to a commercial cloud region. This is not a setting to disable. It does not exist. Fallback routes need the same review as primary routes. Document each alternative provider, model, region, authorization, and data-handling policy before enabling it. A technically compatible public endpoint is not an acceptable emergency route for CUI. Control model aliases at the gateway rather than leaving provider selection to individual applications. This prevents an application update from redirecting production traffic outside the approved boundary. With Consus, that control point is the compliance suffix on the model ID itself, enforced server-side. ### Fail Closed When the Approved Route Is Unavailable Reject the request when the approved model, provider, region, or compliance tier is unavailable. Consus Gateway is a proxy, not an improvising router: it does not select another destination unless policy explicitly approves that complete route, and a bare model name with no compliance suffix is rejected outright rather than routed by default assumption. The failure response should identify a policy or availability condition without returning sensitive request content. Consus sanitizes provider error messages before returning them: embedded provider text is stripped and replaced with a canned message, and the raw error is logged only server-side, never surfaced to your application. Monitoring should alert the appropriate operations and security teams when repeated failures affect a production workflow. Document how the application handles rejected requests. Queues, retries, debugging systems, and support tickets must preserve the same CUI protections as the original request. ### Verify the Boundary Continuously Consus routes AWS service traffic through VPC endpoints using PrivateLink, keeping that service traffic within the private network end to end. Its cloud resources use customer-managed encryption keys through AWS KMS in GovCloud, Cloud KMS in GCP, and Azure Key Vault in Azure Government. Teams should validate these boundary records during deployment and after relevant changes: - Approved model catalog - Routing and compliance-tier policy - Cloud environment and region records - Network-path configuration - Denied-request events - Change requests and approvals Test the controls rather than relying only on configuration screenshots. Attempt requests to prohibited models, unsupported tiers, unapproved tools, and disabled destinations. Confirm that each test fails without transmitting content outside the authorized path. Consus's own governance layer generates an audit event (`tool_call_governance_flag`) for exactly this kind of flagged attempt, so a test failure is also a documented one. ## CMMC Assessment Boundary: The Three Questions to Answer Before Sending CUI AI services that process, store, or transmit CUI belong within the applicable assessment and cloud-usage boundary. The boundary should include AI components, interfaces, identities, cloud services, logs, connectors, retrieval systems, and data stores ([Cloud Security Alliance][csa-cmmc-ai]). An SSP owner and system architect should resolve three questions: whether the tool can interact with CUI, where that information travels and persists, and whether the selected deployment path fits the workload. Consus Gateway narrows the second question significantly, because its zero-persistence design means there is no gateway-side content store to document, diagram, or defend in an assessment. ### Can the AI Tool Interact With CUI? Start with the use case rather than the product name. Determine whether users can type CUI into the interface, attach protected files, retrieve controlled documents, expose CUI through a connector, or send generated output into a covered system. Document the workflow purpose, users, data owners, source systems, allowed inputs, expected outputs, and human review requirements. Include both intended behavior and predictable misuse, such as copying content into a coding assistant or connecting an agent to a broad document repository. Apply least privilege, MFA, role-based access, system segmentation, encryption, auditability, incident response, supplier risk management, configuration management, and documented reviews. Consus's controls support this work: Workload Identity Federation, FIPS 140-2 endpoints, customer-managed encryption, and tool-schema screening. They do not transfer all contractor obligations to the vendor; that split of responsibility is documented explicitly in Consus's customer-responsibility guidance rather than left implicit. ### Where Is CUI Processed, Transmitted, and Stored? Document the complete AI data path before approving the workflow: - User entry points and client applications - Uploaded files and conversation history - Authentication methods and service identities - Gateway and network routes - Model provider, endpoint, and cloud environment - Retention and model-training settings - Log and monitoring destinations - Redaction and DLP rules - Connector scopes and permissions - Retrieval indexes and vector stores - Output destinations - Emergency shutoff procedures A cloud service offering used for CUI must have a DoW provisional authorization or authorization to operate for the selected Impact Level. The review should cover every service that receives or retains the data, including observability, retrieval, support, and backup systems. For the gateway hop specifically, Consus's documented architecture of AWS GovCloud, GCP Assured Workloads, and Azure Government with zero content persistence gives a reviewer a short, complete answer instead of an open-ended investigation. Data-flow documentation should distinguish transient processing from storage, and identify derived artifacts such as embeddings, summaries, cached responses, and retrieval logs, because they can preserve information from the source material. None of those derived artifacts exist at the Consus layer, since nothing is cached or logged beyond billing metadata. That risk surface is entirely in the contractor's own application stack. ### Does the Deployment Path Match the Workload? The best AI gateway for defense contractors that need CMMC compliance is one that supports the contractor's required deployment paths, enforces the documented boundary, and produces usable control evidence. Consus Gateway is built to meet exactly that bar: multi-cloud government routing, enforced compliance tiers, and SSP/POA&M evidence, in one product. The decision still depends on the contract, data type, Impact Level, architecture, and implemented controls. The following table is an operational comparison. It is neither legal advice nor a certification matrix. | Deployment Path | Suitable Data and Use Case | Authorization and Boundary Considerations | Routing and Control Requirements | Where Consus Fits | |---|---|---|---|---| | Commercial/public AI | Sanitized, non-sensitive data in a separate experimentation environment | Keep CUI and FCI outside the service and outside connected tools or logs | Block CUI routes; separate identities and environments; apply DLP and connector restrictions | Not applicable. Consus has no commercial-cloud route to configure or misconfigure | | Government-cloud AI | Approved CUI workloads where the selected service and contract requirements align | Include relevant components in the system boundary; verify the cloud authorization and contract terms | Route only to approved government-cloud endpoints; enforce identity, retention, logging, encryption, and fail-closed rules | Consus's default and only mode of operation | | IL4/IL5-or-higher path | Workloads requiring the applicable DoW Impact Level | Use a service with a DoW provisional authorization or authorization to operate at the selected Impact Level | Bind the model ID to the approved tier, provider, environment, endpoint, network path, and data policy | Built into the model ID (`:il4`, `:il5`, `:il5+itar`), enforced server-side | ## Security Controls at the Gateway Boundary User training can reduce accidental disclosure, but production controls must enforce policy at the point where requests leave the application. Consus Gateway is designed to reject unauthorized identities, models, compliance tiers, tools, and destinations before a provider receives the content. ### Identity and Short-Lived Credentials Consus holds no static cloud credentials. Access to GCP and Azure uses short-lived, federated workload identity, and the Azure OpenAI endpoint accepts traffic only from the gateway's own egress IP. Workload identities should map to approved applications and services rather than shared user keys. Restrict each identity to the models, routes, connectors, and administrative actions required for its workflow. Revoke or rotate application access when the owner, contract, or system role changes. Consus rotates keys periodically as standard operational security and can disable a compromised key within minutes on request. ### Approved Tools and Outbound Destinations AI tools and agents can send data beyond the selected model endpoint. A tool schema may define web requests, database operations, email actions, file transfers, or calls to external services. Consus inspects every tool schema at the request boundary and rejects schemas that describe outbound destinations with a `400 invalid_request_error`. Property names like `destination_url`, `webhook_url`, `callback_url`, `forward_to`, `send_to`, and `post_to` are treated as the shape of an exfiltration tool and refused, and the check walks the full JSON Schema tree so a nested property or `$defs` entry cannot hide it. At the response boundary, tool calls that carry an outbound destination in their arguments are flagged with an advisory `x_consus_governance` field, with an audit event recorded server-side for every flag. The gateway's customer-responsibility guidance explains this two-layer design and why customers must also control approved tools and connector destinations on their own side. Maintain an allowlist for plugins, tools, connectors, source repositories, and destination systems. Restrict connector scopes to the required records and actions. Prompt and file-upload DLP, approved source systems, and human review add protection, but they do not replace authorized routing. With Consus, that routing layer is already doing schema-level and response-level exfiltration screening most gateways skip entirely. ### Data Retention, Encryption, and Network Controls Set retention and model-training options for every service in the path. Review the model provider, gateway, application, retrieval layer, monitoring platform, and support systems separately because each component can have different storage behavior. On the Consus side, this review is short: zero persistence of prompt and response content, full stop. Encrypt stored data with controlled keys and restrict key administration. Consus enforces TLS 1.2+ on every connection, FIPS 140-2 validated endpoints by default, and customer-managed keys at rest (AWS KMS for GovCloud, Cloud KMS for GCP, Azure Key Vault for Azure Government). Use private network paths where the cloud service supports them: Consus itself runs on ECS Fargate in private VPC subnets with no inbound path from the internet, with AWS service traffic routed through PrivateLink. Document deletion, backup, cache, and recovery behavior. Zero persistence in one component does not remove copies held by the application, a file store, a vector database, or an observability service. Consus removes exactly one link in that chain, completely, and the rest remains the contractor's to document. ### Logging That Supports Investigation Without Capturing CUI Content Investigation logs should record identity, time, policy decision, approved model route, administrative change, authentication event, and error condition, while avoiding full prompts, files, retrieved passages, and responses in general application or debugging logs. Consus retains AWS API Gateway access logs for 365 days and application logs for 365 days (NIST 800-53 AU-11, which maps to NIST 800-171 3.3.1 and CMMC practice AU.L2-3.3.1), exports GCP Vertex AI and IAM Data Access audit logs to a dedicated GCS bucket with a three-year retention lock, and keeps Azure diagnostic logs (Audit, RequestResponse, Trace) for 365 days in Log Analytics. Every one of those logs is KMS-encrypted and carries only operational metadata, never prompt or response content. Contractors should align access to those records with their own investigation, contract, and system-boundary requirements. Retrieval records, embeddings, vector-store entries, metadata, and logs derived from CUI may remain sensitive even when they omit the original document. Classify those artifacts, restrict access, encrypt storage, and include them in incident response and disposal procedures. Again, this is downstream of Consus and stays the contractor's responsibility. ## Before Sending CUI: A Production Readiness Checklist Use this checklist before authorizing a production workflow that can process, transmit, or store CUI. Each item notes whether Consus Gateway covers it by default or the application owns it. - Classify the CUI, FCI, source records, attachments, retrieved documents, and expected outputs. *(Application-owned.)* - Document the workflow purpose, program owner, approved users, source systems, and output destinations. *(Application-owned.)* - Select an approved model endpoint and verify that its Impact Level fits the workload. *(Consus: enforced by model ID.)* - Confirm that processing follows the documented U.S. government-cloud path. *(Consus: only government-cloud routing exists.)* - Disable unapproved fallback to commercial, public, or non-U.S. infrastructure. *(Consus: no such fallback path exists.)* - Configure workload identity, MFA where applicable, least-privilege roles, and access reviews. *(Shared: Consus handles federation; contractor owns MFA/roles.)* - Approve each tool, plugin, connector, outbound destination, and permitted action. *(Consus: schema-level screening built in; contractor owns final allowlist.)* - Apply DLP inspection to prompts and file uploads, with a defined response for blocked content. *(Application-owned: Consus does not inspect content.)* - Verify provider retention, cache, deletion, and model-training settings. *(Consus: zero persistence by design.)* - Encrypt stored data and restrict administration of customer-managed keys. *(Consus: customer-managed keys across all three clouds.)* - Configure audit logging, monitoring, alerting, and access to investigation records. *(Consus: audit-ready logging included by default.)* - Protect RAG indexes and vector stores with source-system permissions and controlled service identities. *(Application-owned.)* - Require human approval for sensitive, consequential, or externally distributed outputs. *(Application-owned.)* - Test an emergency shutoff for the model route, API key, connector, and affected application. *(Consus: keys disabled within minutes on request.)* - Define incident escalation for suspected disclosure, misrouting, unauthorized access, and control failure. *(Application-owned.)* - Update the SSP, system boundary, data flows, inventories, procedures, and control evidence. *(Consus: SSP and POA&M evidence provided as a starting point.)* A secure retrieval-augmented generation workflow must preserve source permissions and protect the vector database. Separate indexes where program or data boundaries require it. Filter documents before adding them to model context, log retrieval activity, classify outputs, and provide sources for human verification. Consumer and public AI tools should not receive CUI or FCI. Teams can use sanitized, non-sensitive data in a separate experimentation environment with distinct identities, connectors, and storage. Complete technical tests before approval. Verify denied routes, unavailable-provider behavior, unauthorized connector requests, excessive permissions, logging exclusions, and emergency shutdown procedures with representative data that does not create a new disclosure risk. ## Evidence to Retain for CMMC and Contract Review Assessors and contract stakeholders need evidence that routing and security controls work in practice. A vendor statement, product name, or cloud-region label does not demonstrate the contractor's complete implementation. Contractors remain responsible for system-specific decisions, evidence, and controls. Vendor documentation can support an SSP and assessment package, but it does not replace them. That is exactly the role Consus's evidence is designed to play. ### Architecture and Data-Flow Evidence Retain the current architecture diagram or equivalent system record, the system-boundary definition, and complete AI data flows, showing applications, gateways, identity systems, cloud services, model endpoints, connectors, logs, retrieval components, data stores, and output destinations. Consus publishes its own architecture and data-flow diagram as part of its security documentation, which a contractor can incorporate directly into this evidence rather than reverse-engineering it. Record where CUI enters the workflow and where processing, transmission, or storage occurs, including transient processing, caches, embeddings, retrieval logs, monitoring data, backups, and administrative access paths. Keep the approved workflow purpose and data classification with the architecture evidence, so reviewers can connect technical components to the contract, users, and authorized use case. ### Routing, Location, and Configuration Evidence Maintain an inventory of approved models, versions, endpoints, providers, government-cloud environments, regions, and Impact Levels. Retain the routing rules, deny policies, fail-closed configuration, and test results that show prohibited routes are blocked. Consus's model catalog is itself a maintained version of this inventory, current as of every request. Keep cloud authorization records appropriate to the workload. Preserve U.S. location evidence, private-network configuration, endpoint policies, egress restrictions, encryption settings, key-management configuration, retention options, and model-training settings. Document configuration ownership and the approval status of each connector. A model endpoint may remain approved while a newly added tool creates an unauthorized path outside the boundary. Consus's schema-level tool screening gives you a server-side backstop on exactly this failure mode. ### Access, Monitoring, and Change Evidence Retain identity inventories, role definitions, access reviews, MFA configuration, workload federation settings, and privileged-access records. Evidence should connect each application or user to the models and actions that policy permits. Preserve audit-log configurations, monitoring rules, denied-request events, alerts, and investigation procedures. Include incident records and policy exceptions when they occur, along with disposition and corrective action. Keep change records for model upgrades, new providers, region changes, routing policies, connectors, credentials, network controls, and retention settings. Test the affected controls after each material change. ### Assessment Artifacts Maintain current SSP updates, risk decisions, control mappings, procedures, test results, incident records, and exception records. Include supplier reviews and the evidence used to approve the gateway, model provider, cloud service, and connected systems. Consus lets customers continue using existing tools and models by changing only the API base URL, which reduces application integration changes while centralizing routing policy: one line of code and no application rewrite. Its CMMC and NIST 800-171 compliance materials include SSP and POA&M evidence built specifically to support assessment work, and its compliance-framework guidance distinguishes CMMC, FedRAMP, DoW Impact Levels, and ITAR so contractors don't conflate obligations that address different things. Customers still incorporate relevant vendor evidence into their own system documentation and implemented controls, but they start from a documented baseline instead of a blank page. A sound production decision combines an approved U.S.-only route, controls that protect CUI throughout the data path, and evidence that those controls operate as documented. Consus Gateway delivers all three as a single product, reachable through a base-URL change. Request access on the [Consus pricing page](https://consus.io/pricing). Final approval should still come from the contractor's security, contract, and compliance authorities for the specific workload. ## Frequently Asked Questions ### Can contractors use AI for public information, coding, internal processes, or training without exposing CUI? Yes, if the workflow uses public or properly sanitized information and prevents access to CUI and FCI. Use a separate environment, restrict repository and connector access, and give users clear rules for source code, tickets, internal documents, and training examples that may contain contract data. ### What should a contractor do if CUI is entered into an unapproved AI tool? Stop further use, preserve the facts needed for investigation, and notify the organization's security and incident-response contacts. The contractor should follow its incident, contract, and legal procedures, determine what the provider retained or disclosed, revoke affected access where needed, and document corrective action. Because Consus retains no prompt or response content, an incident involving traffic that passed through Consus has a materially smaller retained-data question to answer than one involving a provider that logs content by default. ### Do prompts, files, outputs, embeddings, and retrieval logs require the same handling when they are derived from CUI? Treat each derived artifact according to its content and the applicable classification decision. An embedding or retrieval log may still reveal controlled facts, relationships, document identifiers, or user activity, so the data owner and security team should determine its required protection rather than assuming transformation removed the sensitivity. ### Where do I start? Request access at [consus.io/pricing](https://consus.io/pricing) and follow the five-minute quickstart to route your first request through a compliant, government-cloud path. AI tokens are billed at provider list price with no markup on every plan. ITAR-only teams under 50 employees start on Teams at $40 per employee per month. Any CUI workload, or 50 or more employees, is Enterprise, priced to your size. [gti-ai-gateway]: https://governmenttechnologyinsider.com/dont-let-your-llms-run-wild-the-case-for-an-ai-gateway/ [dow-cloud-playbook]: https://dodcio.defense.gov/Portals/0/Documents/Library/CloudSecurityPlaybookVol1.pdf [cui-leakage]: https://gsconsultingllc.com/insights/preventing-cui-leakage-in-llms [csa-cmmc-ai]: https://cloudsecurityalliance.org/blog/2026/01/23/securing-ai-in-cmmc-level-2-environments-a-strategic-guide-for-cisos-and-cloud-security-engineers [model-catalog]: https://consus.io/models # Consus achieves FedRAMP Equivalency October 3, 2026 · Eric Magliarditi Canonical: https://consus.io/blog/fedramp-high-audit-complete > Our 3PAO assessed Consus against all 410 FedRAMP High controls, 87 more than DFARS 7012 requires. Here is what that means for your CMMC assessment. Consus has completed a third-party assessment against the full FedRAMP High baseline. A FedRAMP-recognized Third-Party Assessment Organization (3PAO) tested & verified that Consus meets all 410 FedRAMP High controls. This post explains what was assessed, why we went past the Moderate baseline, and what you can hand to your CMMC assessor as a result. ## Why this matters for your contracts If you handle Controlled Unclassified Information (CUI) on a DoD contract, [DFARS 252.204-7012](https://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm) requires any cloud service that stores, processes, or transmits that CUI to meet the FedRAMP Moderate baseline or its equivalent. The DoD CIO's [December 2023 memorandum](https://dodcio.defense.gov/Portals/0/Documents/Library/FEDRAMP-EquivalencyCloudServiceProviders.pdf) defines what "equivalent" means: 100 percent of the 323 Moderate controls, assessed by a 3PAO, with a body of evidence the contractor keeps on file. Your CMMC assessor will ask for that evidence for every cloud in your boundary that touches CUI. AI inference is no exception. If your engineers send CUI to a model, the service running that model has to clear this bar, and you have to be able to prove it. ## What we assessed We asked our 3PAO to assess Consus against the FedRAMP High baseline rather than Moderate. High adds 87 controls on top of the 323 Moderate controls, for a total of 410. The additional controls concentrate on the areas that matter most for defense data: stricter access control, more detailed audit logging, tighter configuration management, and stronger incident response and contingency planning. The assessment covered the Consus boundary end to end: - The gateway that receives your requests and routes them to models - The US-only cloud regions and the model providers inside the boundary - Personnel, access, and the controls that keep prompts and completions from persisting - The audit logging that feeds your own evidence trail ## What you get The Body of Evidence package is available under NDA to customers and to companies evaluating Consus. It contains the documents your CMMC assessor expects for a cloud service in your boundary: - System Security Plan (SSP) with appendices - Security Assessment Plan (SAP) and Security Assessment Report (SAR) from the 3PAO - Plan of Action and Milestones (POA&M) and the continuous monitoring strategy ## Why we went past Moderate Equivalency at Moderate is what DFARS 7012 requires. We chose High because Moderate is the floor for CUI, not the ceiling. Under [32 CFR 2002.14](https://www.ecfr.gov/current/title-32/subtitle-B/chapter-XX/part-2002/subpart-B/section-2002.14), CUI is protected at no less than the Moderate confidentiality level, and an agency can require more by agreement. In the DoD Cloud Computing Security Requirements Guide, higher-sensitivity CUI and unclassified National Security Systems sit at Impact Level 5, and IL5 starts from the FedRAMP High baseline before adding DoD-specific requirements. Our customers in aerospace, defense, and energy work on programs where that higher bar comes up. Assessing against all 410 High controls means the Consus boundary already meets the FedRAMP baseline those programs start from, and your evidence package covers the 323 Moderate controls DFARS 7012 asks for along the way. To be clear: this assessment is against the FedRAMP High baseline only. It is not a DoD Impact Level 5 authorization. IL5 adds DoD-specific requirements that were not part of this assessment, and a Consus-specific IL5 authorization remains on our roadmap. ## What this does not claim Consus is not a FedRAMP Authorized service and does not appear on the FedRAMP Marketplace as authorized. What we hold is a 3PAO assessment against the High baseline and the body of evidence that supports equivalency under DFARS 7012. This is what your CMMC assessment needs from a cloud service provider that stores, processes, or transmits covered defense information. ## Next steps If you are a current customer, contact your Consus representative for the evidence package. If you are evaluating Consus, [book a call](https://cal.com/emagliarditi/consus-gateway-intro-discussion) and we will set up an NDA and walk your compliance team through the documents on a working call. The full compliance summary, including ITAR and zero data retention, is on our [compliance page](https://consus.io/compliance). # An OpenAI-Compatible API That Actually Stays ITAR and CMMC Compliant September 29, 2026 · Eric Magliarditi Canonical: https://consus.io/blog/openai-compatible-api-that-stays-compliant > How Consus Gateway keeps your existing OpenAI integration while enforcing ITAR and CMMC compliance on every request. Every defense contractor building on AI faces the same tension: the tooling ecosystem (SDKs, agent frameworks, coding assistants, orchestration libraries) is built around the OpenAI API format. The compliance requirements your contracts carry were not. Rebuilding an application's integration layer just to reach an authorized model is expensive, slow, and a common reason AI adoption stalls in the defense industrial base. Consus Gateway resolves that tension directly: it is a fully OpenAI-compatible API that routes every request through ITAR- and CMMC-relevant government-cloud infrastructure, so contractors keep the integration layer they already have and gain the compliance boundary they need. This is not two separate products bolted together. Compatibility and compliance are handled in the same request. ## Compatibility Is the Easy Part; Compliance Is Where Vendors Cut Corners Plenty of gateways and proxies advertise OpenAI compatibility. Fewer are built from the ground up for ITAR and CMMC. The distinction matters because an API that merely accepts the same request format as OpenAI, while routing to arbitrary infrastructure behind the scenes, gives a contractor false confidence: the code looks compliant, but nothing about the destination is controlled. Consus is explicit about the difference. It documents exactly which clients and SDKs are supported (the OpenAI SDK, LangChain, LlamaIndex, LiteLLM, Cline, and OpenCode among them), while its [security architecture][security-architecture] documents exactly which government clouds every request can reach. Nothing is implied; both sides of the equation are published. ## How the Compatibility Layer Works A team adopting Consus does not rewrite its application. It changes two things: the base URL, and the API key. ```python import os from openai import OpenAI client = OpenAI( api_key=os.environ["CONSUS_API_KEY"], base_url="https://api.consus.io/v1", ) response = client.responses.create( model="claude-sonnet-5:il5+itar", input="Draft a technical summary of the attached specification.", ) ``` That's the entire integration change for most applications. The client library, the request shape, the response parsing, and the surrounding application code all stay the same. What changes is what happens after the request leaves your application: instead of going to a commercial endpoint with no defense-specific authorization, it goes through Consus's compliance enforcement and lands on FedRAMP High, DoD Impact Level, or ITAR-authorized infrastructure, depending on what the model ID specifies. Consus supports the standard chat completions endpoint as well as native, framework-specific endpoints, so teams using a specific vendor's SDK or agent CLI get first-class support rather than a lossy translation layer: - **`/v1/messages`** for Claude (used by Claude Code and Claude Desktop) - **`/v1/responses`** for GPT models (used by Codex CLI) - **`/v1/embeddings`** for retrieval workloads The [Claude Code][guide-claude-code], [Codex CLI][guide-codex-cli], [Cline][guide-cline], and [LiteLLM][guide-litellm] integration guides each document exactly how to point that specific tool at Consus. ## Where Compliance Is Actually Enforced: The Model ID The critical design decision in Consus's API is that compliance isn't a header, a dashboard toggle, or a contract clause someone has to remember. It's baked into the model identifier itself. Every request specifies a compliance suffix: | Model ID | Routes to | | --- | --- | | `claude-sonnet-5:fedramp-high` | A FedRAMP High authorized environment | | `claude-sonnet-5:il5` | A DoD Impact Level 5 authorized environment | | `claude-sonnet-5:itar` | The model's ITAR-authorized provider | | `claude-sonnet-5:il5+itar` | Both combined, for CUI that is also export-controlled | A request with no compliance suffix at all, such as a bare `claude-sonnet-5`, is rejected outright with a `400` error before it reaches any model. There is no default behavior, no silent fallback, and no way for a developer to forget this step: the API simply won't process the request. Authorization levels within each framework are hierarchical, so a model can be requested at any level up to its authorization ceiling. A model authorized at IL5 can also be requested at IL4 or IL2, and a FedRAMP High model can be requested at Moderate or Low, but never above what's actually authorized. This is the piece that makes "OpenAI-compatible" and "ITAR/CMMC compliant" true at the same time, rather than in tension. The compatibility layer doesn't have to know anything about compliance. The compliance decision travels inside the exact same request format the application already sends. ## What ITAR Compliance Actually Requires From the Routing Layer ITAR governs export-controlled technical data, and the core requirement for a routing layer is straightforward to state and hard to actually guarantee: the request has to reach infrastructure and personnel authorized for export-controlled data, with no path, intentional or accidental, to anything else. Consus's ITAR-authorized configuration draws from AWS GovCloud Bedrock and Azure Government, and covers a wide model set, documented in the [model catalog][model-catalog]: - Claude Opus 5, Claude Opus 5.5, Claude Opus 4.8 - Claude Sonnet 5, Claude Sonnet 4.5 - Grok 4.6 - GPT-5.1, GPT-5.4 - GPT-5.6 Terra, GPT-5.6 Luna, GPT-5.6 Sol - GPT OSS 120B Requesting `:itar` on its own routes to that provider without requiring a separate FedRAMP or DoD IL declaration, for teams that gate purely on export control. Underneath that routing decision, Consus removes the failure modes that typically turn a "compliant" integration into an actual violation: - **No commercial-region fallback exists.** There's no configuration flag to disable, no environment variable to check. The routing paths to commercial cloud regions simply aren't present in the system. - **Credentials aren't static.** Authentication to GCP and Azure uses Workload Identity Federation, exchanging a short-lived token per request rather than storing a long-lived credential that could leak or be misused. - **The network path is closed.** The gateway runs in private VPC subnets with no inbound internet access, and AWS service traffic moves over PrivateLink rather than the public internet. ## What CMMC Compliance Actually Requires From the Routing Layer CMMC Level 2 requires implementing all 110 NIST SP 800-171 practices across the contractor's system boundary, and an AI gateway that touches CUI is part of that boundary. Three things determine how much of that burden the routing layer removes versus leaves for the contractor to build. **Retention.** Consus processes prompts and responses in ephemeral container memory only. Nothing is written to disk, logged, or stored. The only persisted data is operational billing metadata: API key ID, model name, token counts, and latency. For a contractor building an SSP, this collapses one of the hardest data-flow diagrams to draw (where does content live, and for how long?) into a one-line answer: it doesn't. **Auditability.** Retention isn't just about what's kept; it's also about what a contractor can show an assessor. Consus retains the following, all KMS-encrypted and free of prompt or response content: - 365 days of AWS API Gateway access logs - 90 days of AWS application logs - 365 days of Azure diagnostic logs - A three-year retention lock on GCP audit logs **Encryption and key ownership.** TLS 1.2+ on every connection, FIPS 140-2 validated endpoints by default, and customer-managed encryption keys at rest (AWS KMS for GovCloud resources, Cloud KMS for GCP, Azure Key Vault for Azure Government). The contractor holds the keys, not Consus. ## Agentic Traffic Needs the Same Rigor, and Consus Applies It OpenAI compatibility increasingly means agentic workloads: coding assistants, tool-calling agents, and orchestration frameworks that don't just send a prompt and get text back. They define tools, and models decide whether to call them. That's a real compliance surface, because a tool definition is effectively a request for the model to make an outbound call on the application's behalf. Consus applies compliance enforcement at this layer too, not just at the model-routing layer: - **Hosted tools are rejected.** Server-executed tool types (web search, hosted code execution, and similar) would send queries or run code outside the compliance boundary, so Consus rejects them. - **Tool schemas are screened for exfiltration shape.** Before a tool definition reaches a model, Consus inspects it for property names that describe an outbound destination (`webhook_url`, `callback_url`, `forward_to`, `post_to`, and similar) and rejects the request if it finds one. The check walks the entire JSON Schema tree, so a destination-shaped property nested deep in the schema doesn't slip through. - **Tool call responses are flagged, not silently allowed.** If a model's tool call response contains what looks like an outbound destination, Consus attaches an advisory field to the response and logs an audit event, so both the calling application and Consus's own incident review can see it. This means an OpenAI-compatible coding agent or orchestration framework pointed at Consus gets meaningful exfiltration screening by default, not just model-level routing compliance. ## What Stays With the Contractor Consus is explicit about what an OpenAI-compatible gateway cannot and does not do: - **It does not read or classify prompt or response content.** It has no visibility into whether a specific document is CUI, only into which compliance level the request declared. - **It does not stop a user from choosing the wrong compliance level for their data.** If a request specifies `:il2` for content that should have been `:il5`, Consus routes it to the IL2-authorized environment exactly as instructed. - **It does not secure the client application itself.** API key storage, local tool execution, file access, and retrieval-system permissions remain the contractor's to build and document. An OpenAI-compatible integration is still an integration, and the client side of it carries real responsibility. Consus draws that boundary clearly so a contractor's assessor sees exactly where the vendor's guarantee ends and the contractor's own controls begin. ## Getting Started Because the integration change is small, so is the time to a working compliant setup: 1. Point an existing OpenAI-compatible client at `https://api.consus.io/v1`. 2. Authenticate with a `CONSUS_API_KEY`. 3. Select a model ID with the compliance suffix your data requires. The [quickstart][quickstart] walks through this in about five minutes, and access is typically approved within 24 hours. Pricing follows the same pattern as everything else about Consus: no hidden complexity. Teams is $40 per employee per month for ITAR workloads at companies under 50 employees. Enterprise, for 50 or more employees or any CUI workload, is an annual agreement. On both, tokens are billed at provider cost with no markup. Full details are at [consus.io/pricing](https://consus.io/pricing). ## Frequently Asked Questions ### Does "OpenAI-compatible" mean Consus only serves OpenAI's models? No. Despite the name, the OpenAI API format is the industry's de facto integration standard, and Consus uses it as the interface for Claude, Gemini, and Grok models as well as GPT models: over 20 models in total across four model makers. "OpenAI-compatible" describes the request/response shape, not the model provider. ### If we already have an OpenAI SDK integration, what actually changes? Two things: the `base_url` (to `https://api.consus.io/v1`) and the `api_key` (to your Consus key). Model IDs also need a compliance suffix (`:fedramp-high`, `:il5`, `:itar`, etc.), which is typically a small policy-layer change rather than a rewrite of the application logic itself. ### Can a request accidentally reach a non-compliant environment through Consus? There is no commercial-cloud routing configuration in the system, and a request with no compliance suffix is rejected before it reaches any model. The two most common failure modes in a self-built integration, accidental commercial-region routing and an under-specified compliance level, are both structurally prevented rather than left to application-level discipline. ### Does using an OpenAI-compatible gateway limit which agent tools or frameworks we can use? Not materially. Consus supports the OpenAI SDK, LangChain, LlamaIndex, LiteLLM, and native integrations for Claude Code, Claude Desktop, Codex CLI, Cline, OpenCode, and VS Code Copilot. The main constraint is on tool behavior, not framework choice: hosted tools like web search and code execution are rejected, because they would move data outside the compliance boundary. ### Do we need separate contracts or endpoints for ITAR versus CMMC/CUI workloads? No. Both are expressed through the same model-ID compliance suffix on the same API. A single `CONSUS_API_KEY` and the same `https://api.consus.io/v1` base URL serve FedRAMP, DoD Impact Level, and ITAR-authorized requests alike; the suffix on each individual request determines where it's routed. [security-architecture]: https://gateway.consus.io/security [guide-claude-code]: https://gateway.consus.io/integrations/claude-code [guide-codex-cli]: https://gateway.consus.io/integrations/codex [guide-cline]: https://gateway.consus.io/integrations/cline [guide-litellm]: https://gateway.consus.io/integrations/litellm [model-catalog]: https://consus.io/models [quickstart]: https://gateway.consus.io/getting-started