What is a sovereign AI gateway?

A sovereign AI gateway is a single API in front of many AI models, operated so that the location of the computation is part of what it sells rather than an implementation detail. It can tell you which country served a given request, it bills in the local currency, and it states plainly what it retains.

That is the whole definition. The rest of this post is what each clause costs to deliver, and how to tell a real one from a badge on a landing page.

Start with what a plain gateway is

A gateway sits between your application and a set of model providers. Your code sends one request shape to one base URL with a model id in it, and the gateway resolves that id to whichever backend actually serves it. The value is that adding, replacing or re-pricing a model is an operational change rather than a code change in every service that calls it.

Almost every gateway on the market stops there, and for most teams that is correct and sufficient. The location of the machine is not modelled, because the design assumes it does not matter to you.

What the word sovereign adds

Sovereignty is about jurisdiction: whose law governs the hardware your data touches. A sovereign gateway is one where that question has an answer you can check, per request, rather than a paragraph in a policy document.

In practice that means four commitments, and each one is expensive enough that a provider making it usually means it.

• Routes served on hardware the operator runs inside a named country, not resold capacity of unknown origin
• A per-request record of what served the call, available to you and not only to support
• A stated retention position: what is kept after the response, and what is not
• Billing in the local currency, because a foreign invoice reintroduces a foreign dependency

Sovereignty is not privacy, and the two get conflated

Privacy is about who may read the data. Sovereignty is about whose law governs the machine it sits on. A provider can be excellent on the first and still leave you exposed on the second, because a server in another jurisdiction answers to that jurisdiction regardless of the contract you signed with the company that rents it.

For a bank, a hospital, a telco or a government department, the second question is usually the one that decides whether a project ships. It is also the one an engineering team is least likely to have asked, because nothing in the API surfaced it.

Why this became urgent rather than interesting

Two things changed at once. Data protection regimes started naming categories of personal data that must be processed and stored domestically, which turns a hosting preference into a compliance requirement. And large language models became the part of the stack that sees the most sensitive text an organisation holds: the support ticket, the medical note, the transaction history, pasted into a prompt by an application nobody classified as a data transfer.

The result is that a question which used to be answered once, at hosting time, is now answered again on every request, usually by default and usually without anyone deciding.

A prompt is a data transfer

This is the framing most teams have never applied, and it is the one that matters. When an application puts customer content into a prompt, that content leaves the country the moment the request does. A model call is not a computation on data you are holding. It is a transfer of that data to whoever operates the endpoint, followed by a computation there.

It does not matter that the payload is transient, or that the provider says it does not train on it. The transfer happened, and under a localisation regime the transfer is the regulated event.

How to tell a real one from a badge

Ask four questions. A provider that can answer all four is offering sovereignty; one that answers in brochure language is offering a badge.

• For this specific request, which country served it, and can I see that per request rather than in a policy document?
• What is retained after the response, and for how long?
• What currency am I billed in, and who carries the exchange-rate movement between estimate and invoice?
• Can one key be capped, scoped to specific models and expired, and are those enforced by the gateway or by convention?

What it costs, honestly

Sovereign capacity is a smaller pool than the global market, so the catalogue is narrower and a model that launched last week may take longer to arrive. The operator has to run hardware rather than resell it, which in Pakistan means Huawei Ascend NPUs and a toolchain that is not CUDA. Those are real constraints and a provider that does not mention them is not being straight with you.

The honest position is that this is a tradeoff, not a free upgrade. If no regulator, customer contract or procurement questionnaire asks where your data is processed, and paying in a foreign currency is not an obstacle, a global aggregator with a larger catalogue is a reasonable and often better answer.

You do not have to choose once

Because these gateways all speak the same OpenAI-compatible request shape, the decision is reversible and can be made per workload rather than per company. Route the traffic that carries personal data to a pool inside the country, leave the rest wherever it is cheapest, and keep the model id in configuration so the split is a deploy rather than a rewrite.

That is usually the correct answer for a real product: not one provider for everything, but a rule about which data may leave.

Where P/9 sits

P/9 is a sovereign AI gateway for Pakistan. Requests to the PK NPU-native pool are served on Huawei Ascend hardware P/9 operates inside the country, billing is in rupees from prepaid credits at rates published per million tokens, and the request log records what served each call. The gateway retains no prompt and no completion on any route: a log row carries the model, the key, the project, the status, the timings, the token counts and the settled cost, and nothing of what was said.

Whether that is worth choosing over a larger global catalogue depends entirely on whether anyone is going to ask you where the data went. Increasingly, somebody does.