Understand where your AI requests go, how data is handled, and what evidence is available for your review.
Tier 3 routes select Canadian provider regions. Available routes include AWS Bedrock and Microsoft Azure. Canadian residency is distinct from Canadian ownership of the underlying cloud provider.
Tier 4 includes US and global execution boundaries. Review the selected route's provider, jurisdiction and data-use terms rather than assuming it has the same protections as a Canadian route.
Choose the exact route from the model catalog. Provider and region are part of the assessment; the tier alone is not a certification.
Training, retention and abuse-monitoring policies are disclosed per route. No training does not mean zero retention. Review the data-use disclosures and Privacy Policy for NI's handling and the applicable provider terms.
Authenticated access and encrypted connections protect access to the service. Operational records support usage reporting and investigation. Review content-capture settings and retained metadata before processing sensitive information.
Optional PII substitution replaces detected identifiers on supported text paths. It is not guaranteed anonymization, and substitution audit records have their own retention considerations.
Custody records identify the route and provider NI selected, with recorded jurisdiction information. Response headers are unsigned route summaries. When signing is available, NI also provides a signed custody record covering its selected path up to the provider boundary. Provider evidence governs execution inside the provider.
Use these records alongside provider documentation, contracts and your own validation. A custody record is evidence for your review, not a substitute for assessing the complete workload.
NI's platform infrastructure and the model provider are different parts of the request path. AWS attestations apply to the AWS services and regions in their scope; Microsoft attestations apply to the Microsoft services and regions in theirs. They are provider assurances, not certifications of Northern Inference or of every route in a tier.
For procurement, match the evidence to the actual provider, service and region used. Access and redistribution of provider reports are subject to their terms.
We work with customer privacy, security and procurement teams on the evidence needed for their workload. For government deployments, we support the department's security assessment and authorization process for the service in scope.
Contact us to discuss control documentation, provider-assurance references, custody verification and data-handling procedures. Detailed security architecture and supporting evidence can be reviewed under an appropriate confidentiality agreement.
Procurement, audit evidence, and SA&A engagement: trust at northerninference dot ca.
Security disclosure: abuse at northerninference dot ca.
General inquiries: hello at northerninference dot ca.
Security · Privacy Policy · Terms of Service · Acceptable Use Policy