Zero-Retention Routing

Some data cannot go to a provider that keeps it. That limit usually lives in a contract clause rather than in a runtime setting. This starter makes it a runtime setting, and it fails closed when no approved destination exists. Local masking runs first, so less leaves the building even on an approved path.

The routing restriction is the whole idea. Only a target that operators mark as no retention and no training may receive the traffic. When no such target is available, the request is blocked instead of falling quietly to another provider. Provider selection is recorded, so a reviewer can see which target handled a call.

Two controls run before that choice is made. Injection screening rejects a prompt at 0.80. Redaction masks national identifiers and health membership numbers, so personal data is gone before an approved target sees the prompt. Order is the point here, because masking comes first and routing comes second.

The retention label is operator declared. It reflects what your team recorded about a provider, not a measurement of provider behavior. The shipped file deliberately includes one target that fails the test, so a reviewer can prove that routing excludes it. Confirm contract terms, account settings and real runtime behavior before you rely on this starter.

A response that falls under a combined 0.80 or an accuracy of 0.85 is blocked. Capture is not enabled in the shipped file, and the redacted option is present but commented out. There is no identity requirement and no term based safety rule, so pair this starter with one that supplies them. The audit marker records an evaluated request and creates no storage of its own.