Launch HN: Consus (YC F24) – LLM gateway for companies handling sensitive data

Consus is pitching itself as the safe middle layer for companies that want to use AI without handing sensitive data to just any model provider. The startup says it routes requests for ITAR-restricted and CUI-covered work through compliant infrastructure, and it recently finished a FedRAMP equivalency audit against the 410 FedRAMP High controls. That matters because FedRAMP High is the government’s toughest cloud baseline for sensitive unclassified data.

Founder Eric says the pain is especially obvious in aerospace and defense, where companies want the same AI tools everyone else has but are boxed in by compliance and vendor risk. He says he saw that up close at SpaceX and later at Castelion, and even encountered a satellite maker that wouldn’t allow any AI tools at all, including for non-sensitive work. The problem isn’t that these teams don’t see the upside. It’s that they’re thinking about data training, ITAR violations, and failed cyber assessments at the same time.

Consus’ answer is a compliance layer that sits in front of AI tools and workflows. It can connect to products like ChatGPT and Claude, open source tools such as the Pi coding agent and Open WebUI, or software built inside a company. Requests go to one OpenAI-compatible endpoint, keys are checked, policies are enforced, and every model name has to include a compliance suffix such as gpt-5.6-sol:fedramp-high or claude-opus-5-5:itar. Bare model names are rejected, and the company says it never proxies to standard commercial endpoints.

The startup is also trying to collapse a messy cloud problem into one place. Eric says most aerospace and defense companies do not live in all three major GovClouds, and the models they can legally use are split across providers. Consus wraps that up behind one endpoint and handles the compliance work for each model. Customers can set allowlists, assign spend limits, and lock model access down by user through the Consus Portal.

Privacy is a major part of the pitch. Consus says it stores no customer data at rest, keeps prompts and completions in memory only for the life of the request, and does not log or write them to disk. It does keep request and response metadata for billing and audit. The product is not self-serve: the company verifies each organization and puts a contract in place before issuing API keys. Pricing starts at $40 per seat per month plus AI tokens at cost, and the team says it is already serving customers.