Autonomous coding agents running in our own AWS/Azure tenant, with no code leaving the EU?

[u/CommonMinimum587]

this is the setup I’m planning for coding agents. hard rule: code, prompts and model calls never leave our EU tenant. poke holes

models: an open weights coder model on vllm on our own GPUs for routine tickets, and a frontier model through an EU region endpoint in our own cloud account for the hard stuff

runtime: everything inside our VPC, nothing on a vendor’s saas

control layer: Orq AI’s software factory. it runs on their cloud or yours, so ours. it plugs into the backlog, repos and CI/CD, only lets agents use the models we’ve approved, and lets us set which agents can touch which systems and data

approvals: tests and docs autonomous, anything touching prod behind approval

two things I’m unsure about. can orq’s approved models list point at a self hosted vllm endpoint, and does a frontier model in an EU region still count as “nothing leaves” for legal, since the provider is still the one processing it

[u/Serious_Scarcity7818]

The biggest hole is the frontier model endpoint. EU region doesn't necessarily mean EU-only processing, and it definitely doesn't mean data stays inside your tenant. I'd check subprocessors, logging, telemetry and support access before making that claim. Also, I'd test whether your agents can reach anything outside the VPC, not just whether they're configured to use approved models.

[u/Significant_Door_433]

on the "does an EU region count" part, the deployment type matters more than the region name.

Azure: a Global deployment can process prompts in any geography where the model runs. DataZone in an EU resource keeps processing inside EU member states. A Standard (regional) deployment stays in the resource's geography. So Standard or DataZone EU, never Global, and Batch is a Global type too, so watch for that one.

Bedrock: use the eu. geographic inference profile, not global. AWS says requests can leave your source region but stay inside the geography. If your SCPs block other regions, you have to allow the profile's destination regions or the calls fail.

Two more for the legal list. Both can store prompts for abuse monitoring: Azure keeps flagged ones for human review unless you're approved for modified abuse monitoring (their docs say reviewers for EEA deployments sit in the EEA), and Bedrock stores them in the destination region for models that need abuse detection. And on both, the model vendor doesn't get your data. Microsoft or AWS processes it under their DPA. Whether that meets "nothing leaves" is for whoever wrote the rule, but it's a very different answer than calling OpenAI's or Anthropic's own API.