Sovereignty you can audit. Cost transparency you can recompute. A public log of what we deliberately chose not to build.
Most "Canadian AI" claims are a logo and a vague promise about where the servers live. Ours is enforced on every single API call. Three things make that possible:
Each model response returns unsigned headers that record the route Northern Inference selected, including provider, region, jurisdiction, credential source, and custody path. The corresponding portal and API custody record carries a canonical digest and, when the signing service is available, an Ed25519 signature from Northern Inference. The signature lets an auditor verify that the attestation came from our published key and that its signed fields were not altered. It does not independently prove provider-internal execution; provider documentation, attestations, and contracts govern what happens inside the provider.
If a request ever resolved to a different region than the deployment claimed, the headers would say so. There is nowhere for sovereignty to hide.
For Vertex AI routes, before each call dispatches the gateway resolves the upstream hostname's IPs and checks them against Google Cloud's own published prefix range for that region. If the resolved IPs don't belong to the expected jurisdiction's range, we record a drift event and (in enforce mode) reject the request with HTTP 403 before any data leaves our infrastructure. Bedrock and Azure routes call a fixed regional endpoint and are protected by the fail-closed residency guard below.
The source of truth is Google Cloud's public IP-range catalog, refreshed daily. The check runs in-process before provider dispatch. Drift events are visible in the operator's admin UI as a live count and click-through table.
A deployment tagged for Canadian residency is enforced at the routing layer. If the underlying region or SKU resolves to a different jurisdiction, the deployment is silently REFUSED from serving traffic rather than quietly routing to the wrong region. Operators see the mismatch in an admin page; customers see a clear error pointing at a known-good alternative.
Our 0% token-markup commitment is auditable. Each settled request exposes the provider-rated usage cost and any Northern Inference per-request fee separately. Credit purchases carry the disclosed 9% service fee; BYOK requests use the configured free allowance and flat overage policy.
Our model pricing is checked against authoritative and independent sources, including AWS pricing data and Azure Retail Prices. The pricing-sanity worker records divergent or stale rows for operator review and alerting. If a stored rate differs materially from an authoritative source, the finding remains visible until it is resolved.
The monthly reconciliation job joins request-log charges against the rate snapshots captured at request time and looks for systematic billing differences. Its per-team findings are retained in an operator report and can generate an alert when configured thresholds are exceeded.
When a new model rate is added, the gate refuses anything more than 2× off comparable rows. This catches accidental overrides at the moment they'd cause damage rather than at end-of-month.
total_cost_cents for the provider-rated usage cost in USD cents, ni_fee_cents for any NI per-request fee in USD cents, charged_cad_cents for the actual CAD balance deduction, and fx_rate_used for the applied conversion. Sum charged_cad_cents to reconcile the usage deductions shown in your account.
Most pitches in our space claim coverage of every threat model. We document our refusals out loud, with the reasoning. Reading our deferred-decision log is itself a trust signal.
An example. Our jurisdiction drift detection has two enforcement vectors: pre-call DNS+IP-geo verification (shipped) and HTTP 30x redirect interception during the upstream call (deferred by decision). The redirect interception addresses a contrived threat model. Vertex's regional load balancer uses Anycast origin failover, not HTTP redirects. Bedrock's control plane uses regional endpoints with no cross-region redirects. Azure Cognitive Services the same. We had no realistic way to test the deferred half against actual drift, and implementing it would have required deeper access to a black-box dependency than we'd want to take on for a threat that doesn't exist in production. So we shipped the half that maps to the real failure mode (DNS pointing at unexpected IPs after a regional reroute) and wrote down the choice. If a customer audit asks for in-flight redirect interception, or if we ever observe a real redirect-based drift event in the wild, we'll reopen.
The full deferred-decision log lives in our internal docs. We will publish a public summary when we reach the SOC 2 audit gate; until then, this and other examples will surface here as they come up.
audit_logs table with category, severity, IP, user-agent, full detail JSONB. Filterable + exportable.We're not SOC 2 Type II certified yet. The roadmap is gated on customer demand. When an enterprise prospect asks, we engage Drata or Vanta for continuous evidence collection and start the 6-month observation window with an A-LIGN or Schellman audit at the end. Today, our compliance posture inherits from the cloud providers we run on (AWS SOC 2 Type II, ISO 27001, PCI-DSS attestations are downloadable from AWS Artifact and we mirror them quarterly into our own compliance archive).
HIPAA BAAs aren't yet signed. Free on AWS / Azure / GCP, but a signal we wait until a healthcare customer asks. Same for ISO 27001 and the EU AI Act framework.
Email trust@northerninference.ca for compliance questions, vendor reviews, or audit-evidence requests. Email abuse@northerninference.ca if you've discovered a security issue.