Third-Party Model APIs Break Residency. Quietly

We keep finding the same pattern. The production agent is installed in the SDC. The slide says on-premise. A configuration flag still points at a commercial model endpoint for embeddings, reranking, speech-to-text, or the long-context fallback. Nobody updated the data-flow diagram. The demo never failed, so nobody looked.

This is not a story about reckless departments. It is a story about default settings. Defaults travel farther than policy.

The quiet calls

• Embedding APIs that send chunk text abroad and return a vector.
• Rerankers that receive the query plus the top chunks.
• Speech and OCR APIs that receive citizen attachments.
• Guardrail APIs that receive the full prompt for safety scoring.
• Timeout fallbacks to a hosted large model when the local GPU is busy.
• Licence or usage meters that include prompt hashes and user ids.
• Crash reporters that ship the last prompt with the stack trace.

Each call can be a transfer of personal data. Each one is also a processor you may not have named. Each one can retain a copy under the vendor's abuse, safety or improvement policy. Safety is the most respectable hiding place. It is still a store you do not operate.

How to find them this week

1. Force the staging system through a proxy that logs SNI and destination. Keep the log.
2. Disable outbound internet and watch what dies. Whatever dies was a hidden dependency.
3. Read the orchestrator config for base URLs that are not yours.
4. Ask for the vendor's sub-processor list and match it to those URLs.
5. Search source control for api., openai, anthropic, google, azure, groq, together, huggingface, and the names of Indian hosted models you did not approve.
6. Ask the SI for every key in their password manager that is not yours.

Do this on staging before production. Doing it in production is how you discover a transfer in front of a journalist.

How to make the quiet call loud

Require that any outbound model, OCR, speech or guardrail endpoint be listed in a schedule. Unlisted endpoints are a material breach. Then enforce it with an egress proxy, not with trust. Trust is not a control. Proxies are.

Give developers a legal path for exceptions. If the only path is hide the call, they will hide the call. A named exception with a transfer note is better than a heroic default that nobody can defend.

Hosted APIs are legitimate when they are chosen, named, contracted and limited to data classes that may travel. They are poison when they are a convenience left in the default config. Convenience is how residencies die.

Developer defaults are a management problem

Engineers paste an API key because the README said to. That is not a moral failure. It is a missing allow-list, a missing proxy, and a missing review of the README. If your staging network can reach the public internet without a ticket, you have chosen convenience over residency. You may do that. You may not then claim surprise.

Give developers a local model that is good enough for day-to-day work. If the only fast path is a public API, the public API will win at 6pm before a demo. Provide the boring path. Then punish the unofficial path. Providing without punishing is a suggestion. Suggestions do not survive deadlines.

Indic language is not an excuse to hide a call

Hosted OCR and speech APIs are often justified because local engines stumble on regional scripts. That can be true. If it is true, write it as a named exception with a transfer note and a plan to replace it. Do not let a quality gap become a permanent silent path. Quality gaps are funded. Silent paths are found by auditors.

Hunt quiet calls for two weeks, then close the network

Week 1 is discovery. Proxy, internet-off test, config grep, password-manager review, intern .env hunt. Write every destination on one page. Week 2 is judgement. Each destination becomes a listed exception with a transfer note, or it dies. There is no third column called we will watch it.

Then close the network. Staging and production lose default outbound internet. Developers get a local model that is good enough. Unofficial keys become a disciplinary matter after you have provided the boring path. Providing the path without closing the network is a suggestion. Suggestions lose to 6pm demos.

Indic OCR and speech, if they must stay hosted, become named exceptions with a replacement plan and a date. Quality gaps are funded. They are not allowed to remain unnamed hops.

Objections you will hear — and what to do with them

Developers will say the key is only in staging. Staging copies of production are production. Treat them as such. If staging is a scrubbed synthetic set, the key is still a path that will be copied into production at 6pm. Close the path.

SIs will say they need outbound internet to patch. Patches can come through a controlled update channel. Unfiltered outbound is not a patch strategy. It is a hope that nobody uses it for a model API.

A vendor will say their API is in an India region so residency is fine. Read the control-plane article. Also read the logs. Many India-labelled APIs still write abuse-review copies elsewhere. Ask. Then proxy.

Leadership will fear that deny-by-default will stop all work. It will stop unofficial work. Official work should already have a listed path. If official work dies, you have just found official work that was unofficial. That is a successful test.

Someone will propose a monthly review of keys instead of a network close. Monthly reviews miss the intern's weekend. Networks do not. Review plus deny-by-default. Review alone is a spreadsheet.

How this shows up in the file

The quiet call is almost never malice. It is a README and a deadline. Your job is to make the unofficial path fail loudly and the official path work well enough that people use it. Deny-by-default plus a usable local model. Either half alone will lose.

Named exceptions for Indic OCR or speech are allowed if they have a transfer note and a replacement date. Unnamed exceptions are how residencies die. Quality is funded. Silence is found.

After you close the network, keep the deny log. It is the most honest architecture diagram you will ever own. Review it weekly for a month, then monthly. New hostnames are new findings, not weather.

What the next noting must contain

“Third-Party Model APIs Break Residency. Quietly” belongs in a file, not only in a search result. A P1 CIO/CTO should be able to point at one artefact that proves “model API data residency”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

The commonest hidden violation is not a rogue USB stick. It is a HTTPS call a developer added so the demo would not stall. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C1 Sovereignty & Data Residency: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “model API data residency”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.