Hey Hacker News! I'm Eric, the founder of Consus. We route all AI requests to ITAR restricted and controlled unclassified information (CUI) compliant infrastructure. Consus itself satisfies ITAR restrictions, and we recently completed our FedRAMP equivalency audit against the 410 FedRAMP High controls. FedRAMP High is the U.S. government’s strictest security baseline for cloud services handling sensitive unclassified data. A breach of this data could cause severe or catastrophic harm. Achieving FedRAMP equivalency, or authorization, is required before processing CUI information.

Aerospace and defense is experiencing rapid growth. Unfortunately, most companies are struggling to use AI because of necessary data protections & compliance risk. These companies can move even faster if they could use the AI tools that most other industries take for granted.

I spent most of my career prior to Consus in aerospace & defense. I launched national security payloads at SpaceX, and was an early employee at Castelion. I’ve watched first hand how compliance red-tape makes it difficult for companies to adopt new technologies and trust vendors that touch their sensitive data. For example, I worked with a satellite manufacturer that doesn’t allow any AI tools, even for non-sensitive work.

Even as AI has become extremely useful over the past 9-12 months, I was surprised by how many aerospace & defense companies refused to touch it. They could see how it could be helpful, but they were scared about model providers training on their data, violating an ITAR rule, or risk losing new business because of a failed cyber assessment. These are all rational fears.

There were a lot of ways to solve some/all of these problems, but we focused on building a compliant AI inference layer that can "plug" into any AI tool or workflow. Just as OpenRouter integrates with most tools, Consus can connect to tools like ChatGPT or Claude, open source tools including the Pi coding agent or Open WebUI, or integrate with applications built and maintained by individual organizations.

Almost no aerospace & defense company lives in all three major GovClouds (AWS, Azure, Google). When I mapped where frontier models can legally run for ITAR and CUI work, each provider had some subset of models, and each model achieved varying levels of compliance. Our customers don’t think in terms of cloud providers. They think about the data controls they require, and the model they want to use. That is why we built the compliance suffix. Under the hood, every request hits a single OpenAI-compatible endpoint, where keys are verified and policy is enforced before anything touches inference. Every model name must carry a compliance suffix, such as gpt-5.6-sol:fedramp-high or claude-opus-5-5:itar, and any bare model name is rejected. We never proxy to the standard commercial endpoints.

Our customers are also able to build an allowlist of models, and assign spend & model restrictions to individual users in the organization. This is all handled through our Consus Portal where teams can manage spend, keys, and policies.

A typical question we hear is why not just use Bedrock in AWS GovCloud or Azure Government directly. For small teams, just getting access to these platforms is difficult. For larger organizations, GovCloud lets you inherit some but not all of the controls needed to handle sensitive data. Also, models are split across providers: GPT-5.6 Sol is only available in Azure Government, while Claude Opus 5.5 is served through Bedrock in AWS GovCloud. If you want both, you are standing up and securing two separate government cloud environments. We run all of them behind one endpoint so customers don’t have to pick a cloud, and we handle the compliance work for each one.

Given the data sensitivities, Consus does not store any customer data at rest. All prompts and completions stay in memory only for the length of the request and are never logged or written to disk. Zero data retention is strictly enforced both on ourselves and the infrastructure/model providers. We do keep metadata on each request and response for billing and audit purposes.

Consus is not self-serve by design. ITAR requires us to know exactly who is on the other end of every key, so we verify every organization and put a contract in place before issuing API keys. We charge our customers a compliance fee starting at $40/mo/seat plus AI tokens at cost.

We are actively serving customers, and would love any feedback from security experts, or developers/engineers working in highly regulated industries!

References: API Documentation: https://gateway.consus.io/overview Security & Architecture: https://gateway.consus.io/security Compliance Details: https://consus.io/compliance

The Private Life of a Cat (1945)

Nvidia falls to 34% of China's AI chip market as Huawei takes 28%

Slopcore – A Guide to Claudia

Unparliamentary Language

Redesigning Source Control at Anthropic

The fastest open Firebase alternative – an 8-way benchmark comparison

Show HN: RemainderBot – spends leftover Claude/Codex quota on reviewable PRs

Keepword a decentralised network that checks if a company silently edits TOS

The Rise and Flush of Skibidi Toilet

Show HN: Revise CLI

The AI Enthusiasm Gap

Launch HN: Consus (YC F24) – LLM gateway for companies handling sensitive data

Perplexity's AI agents helped build a database with Rust

Now That Information Is Free, What's a College Campus For?

Server44 – Tip tracker for servers and bartenders

Factories are automated. Their back offices are stuck in 1995

Scammers Steal Millions from Food Stamp Recipients. Congress Won't Fix It

China Reduced Extreme Poverty Fast, but Indonesia Hasn't Been Far Behind

Bundestrojaner

Singapore's bank wants all FinTech AI use cases subject to independent review

Augmenting Human Intellect (1962) [pdf]

Palantir CTO:Some AI researchers taking up smoking;they expect AI to cure cancer

Deprecation of HashiCorp Boundary Community Edition

The model that didn't exist, so you made it yourself

Look, just fucking use Mastodon

I posted to HN, and then my website was flooded with AI bot traffic

Show HN: pg_vectorsearch: Scalable Open-Source Vector Search in PostgreSQL

Investigators hunt French supermarket fridge hackers, no claim of responsibility

Don't Run the Race – Grow

Terry Tao Book Tour: NYC, Boston, Kansas City