Singapore-Hosted AI Gateway: Running Production LLMs and Agents Under PDPA, DPDP, and APPI

TL;DR: Most hosted AI gateways route every request through US compute and treat Asian model providers as an afterthought. Leanroute is incorporated and hosted in Singapore, with gateway compute, Postgres metadata, and Redis caching running in the region. Combined with one-click no-persistence mode (x-gateway-prompts-persisted: false), AES-256-GCM encrypted BYOK keys (including AWS Bedrock in your own AWS account), built-in PII redaction guardrails, and 14 curated providers spanning Western frontier, China/APAC (Qwen, GLM, Doubao, Kimi, DeepSeek), and India (Sarvam, Krutrim), it gives APAC engineering teams a simpler compliance story to take into security review.

The compliance gap with US-centric LLM routers

When a Singapore, Hong Kong, Japan, or India engineering team evaluates an AI gateway like OpenRouter, Portkey, or Vercel AI Gateway, three operational friction points come up in security review:

1. Unnecessary cross-border hops for regional traffic: If your application runs in ap-southeast-1 (Singapore) and calls Claude on AWS Bedrock (ap-southeast-1) or an APAC provider, routing the HTTP request through a US gateway adds a trans-Pacific round trip to every call and puts your gateway middleware under US jurisdiction.
2. Opaque prompt caching and persistence: Many routers cache prompts or log request bodies by default without giving compliance teams a cryptographic or header-verifiable way to prove that prompt persistence is disabled.
3. Missing regional model catalogs: Western gateways carry hundreds of fine-tuned Llama variants but often lack first-class, price-accurate support for Alibaba Qwen (qwen3.8-max, qwen-vl-ocr), Z.AI GLM (glm-5.3), ByteDance Doubao (doubao-seed-2.1-pro), Moonshot Kimi (kimi-k3), Sarvam (sarvam-105b), and Krutrim (krutrim-spectre-v2).

How Leanroute is architected for Singapore & APAC compliance

Leanroute Pte. Ltd. is a Singapore-incorporated company, and our primary production control plane (gateway compute, database, and cache) runs in Singapore.

Control Layer	What Leanroute Does Today	How You Verify It
In-Region Compute & Metadata	Gateway compute, request log metadata (model, token count, latency, USD cost), and Redis caches run in Singapore. Prompt content is never written to Postgres.	Documented in our Compliance Posture and sub-processor table.
Verifiable No-Persistence Mode	Flip on No-persistence mode in /dashboard/settings to bypass both exact-match and semantic Redis caches completely. Prompts exist only in runtime memory for the duration of the HTTP call.	Every response emits x-gateway-prompts-persisted: false so your monitoring can assert compliance on every call.
In-Process PII & Secret Redaction	Seven built-in Guardrails run in-process on Singapore compute. PII redaction replaces email addresses and card numbers, and secret detection catches API keys, before the prompt leaves the gateway. Phone numbers are matched at a lower severity and only redacted if you lower the rule's threshold.	Check x-gateway-guardrails-triggered on responses (for example pii-redaction,secret-detection); run a rule in Preview mode for 7 days to see what it catches before it acts.
AWS Bedrock BYOK	Bring your own AWS credentials (for example region ap-southeast-1) to run bedrock/anthropic.claude-sonnet-4-5 and bedrock/anthropic.claude-haiku-4-5 in your own AWS account while keeping Leanroute's spend caps, logging, and OpenAI wire format. Claude on Bedrock uses AWS's APAC cross-region inference profile, so AWS may serve a request from another APAC region.	Response emits x-gateway-byok: true and x-gateway-provider: bedrock.
Zero-Markup Flat Pricing	$15/mo Starter or $25/mo Pro BYOK subscription with $0 per-request markup, or prepaid credits with a one-time 5% deposit fee.	Non-streaming responses carry x-gateway-cost-usd, priced at the provider rate shown in the Model Catalog; streamed requests show cost in your request logs.

Mapping your architecture to PDPA, PDPO, DPDP, APPI, and GDPR

• Singapore (PDPA) & Hong Kong (PDPO): Compute, database, and cache reside in Singapore by default. Pairing AWS Bedrock BYOK with no-persistence mode keeps gateway processing in Singapore and model inference inside AWS's APAC regions, under your own AWS account. Requests to US-based providers such as OpenAI or Anthropic's own API do leave the region; the Compliance page lists which providers process where.
• India (DPDP): Using BYOK with India-hosted providers (Sarvam and Krutrim) bills tokens directly to your domestic provider account while enforcing hard daily/monthly spend caps at the gateway edge.
• Japan (APPI) & EU (GDPR): Standard data-subject rights (access, deletion, wipe-cache-now) are built into the dashboard, and a signed Data Processing Addendum (DPA) with EU Standard Contractual Clauses (SCCs) is available on request.

Next steps

1. Review our full regulatory matrix and sub-processor list on the Compliance page and Security page.
2. Compare Leanroute side-by-side against OpenRouter, LiteLLM, and Cloudflare AI Gateway.
3. Test live routing, caching, and secret-redaction guardrails in your browser without signing up on the Leanroute Playground.