Consus launches LLM gateway for ITAR and CUI compliant infrastructure

By Splitfeed EditorialLast updated Oct 13, 2026, 16:10 UTC

On October 13, 2026, Eric, the founder of Consus, a Y Combinator F24 company, announced the product publicly on Hacker News. Consus offers an LLM gateway that routes AI requests through infrastructure compliant with International Traffic in Arms Regulations, known as ITAR, and Controlled Unclassified Information, or CUI, standards. The company states it has completed a FedRAMP equivalency audit covering all 410 FedRAMP High controls, which represents the U.S. government's strictest security baseline for cloud services handling sensitive unclassified data, defined as data whose breach could cause severe or catastrophic harm.

The significance of this launch sits at the intersection of two fast-moving trends: rapid enterprise and government adoption of large language models, and a regulatory environment that has struggled to keep pace with that adoption. ITAR governs the export of defense-related materials and technical data, meaning organizations in defense contracting and aerospace face serious legal exposure if AI queries touch controlled information through non-compliant channels. FedRAMP High authorization, or an equivalency audit against its 410 controls, is a substantial compliance threshold that few commercial AI infrastructure providers have cleared. Whether a FedRAMP equivalency audit carries the same weight as full authorization is a distinction that procurement officers and compliance teams are likely to scrutinize closely.

With no published reactions available from the Pro-AI, Anti-AI, or Middle Ground camps, their positions can only be anticipated based on how each typically approaches stories of this kind. The Pro-AI camp would likely treat this as evidence that AI infrastructure is maturing into regulated industries responsibly, pointing to the audit as proof that deployment need not wait for perfect conditions. The Anti-AI camp would probably raise questions about whether compliance certifications adequately address the broader risks of feeding sensitive government or defense data into AI systems at all, regardless of where that data is routed. The Middle Ground camp would most likely focus on the gap between equivalency and full authorization, arguing that the distinction matters and that rigorous independent verification should precede widespread government adoption.

The clearest next signal to watch is whether Consus pursues and achieves full FedRAMP High authorization beyond the equivalency audit, and whether any government agencies or defense contractors publicly confirm contracts with the company. Those developments would either validate the compliance posture Eric described at launch or surface gaps that the equivalency audit did not resolve.