Data Flow & Subprocessor Register
Project Pak-LLM operates a Hybrid Sovereign AI Architecture. Domestic control planes, PII sanitization, and cryptographic ledgers remain strictly anchored in Pakistan, while high-throughput inference acceleration executes under verified Zero-Data-Retention (ZDR) agreements.
Hybrid Sovereign Architecture Data Flow Boundary
1. Domestic Control Plane
Anchored in Pakistan. Handles account governance, PII scrubbing (Amanah Gate), domestic Swich payment clearing, and cryptographic audit ledgers.
- • CNIC & IBAN auto-masking
- • 1% Swich statutory tax rails
- • Localized Shariah guardrails
2. Ephemeral Inference (ZDR)
Queries pass through enterprise accelerators (Groq LPU, Hugging Face, Render) via TLS 1.3 under strict Zero Data Retention terms.
- • Volatile RAM memory only
- • 0 bytes saved to foreign disks
- • ZERO customer data model training
3. Private Air-Gapped Node
Optional enterprise deployment on dedicated customer-owned on-premise hardware (Dell / Huawei) with zero external connectivity.
- • 100% on-premise data residency
- • SBP & Defense grade compliance
- • Private GGUF Q4_K_M weights
Authorized Subprocessors Register
Updated: October 15, 2026| Subprocessor & Entity | Category & Purpose | Jurisdiction | Data Transferred | Security Safeguards | Data Retention |
|---|---|---|---|---|---|
Vercel Inc. Vercel Inc. (Delaware, USA) | Hosting & CDN Edge CDN routing, DNS, Serverless execution & WAF protection | USA / Global Edge | Encrypted HTTPS request payloads, IP headers, transient edge logs | TLS 1.3, HSTS Preload, Automated DDoS mitigation, SOC 2 Type II | Transient edge logs (max 30 days) |
Google Firebase Google LLC (Delaware, USA) | Identity & Auth User authentication, OAuth handshake, and Session management | USA | Email address, hashed authentication tokens, anonymous UID | AES-256 at rest, TLS 1.3 in transit, ISO 27001, SOC 2/3 certified | Active account lifecycle only |
Neon Tech Inc. Neon Inc. (Delaware, USA) | Database & Storage Serverless PostgreSQL database, conversation threads & metadata | USA / EU Region | Row-level isolated conversation threads, RAG collections, encrypted credentials | AES-256-GCM disk encryption, ML-KEM-768 post-quantum key encapsulation, tenant isolation | Until account deletion or user-initiated thread purge |
Groq Inc. Groq Inc. (Delaware, USA) | AI Inference (ZDR) High-speed LPU inference acceleration for reasoning & text completions | USA | Ephemeral prompt tokens for fast reasoning | Contractual Zero-Data-Retention (ZDR), volatile RAM processing only, zero model training | 0 bytes stored — strictly purged upon stream completion |
Hugging Face Inc. Hugging Face Inc. (Delaware, USA / France) | AI Inference (ZDR) Private dedicated model endpoints & sovereign model inference routing | USA / France | Ephemeral code snippets & query tokens for private PakLLM_Coder inference | Encrypted token transit, dedicated inference instances, strict zero-training terms | 0 bytes stored — ephemeral in-memory processing only |
Render Services Inc. Render Services Inc. (California, USA) | AI Inference (ZDR) GPU acceleration micro-node for image & video synthesis | USA | Transient visual prompts and generation parameters | TLS 1.3 transit, immediate post-generation frame transfer, zero model training | Transient scratch memory — purged immediately post-render |
Swich Payment Rails Swich Payment Solutions (Private) Limited (Karachi, Pakistan) | Payment Rails Domestic Riba-free payment processing & 1% statutory tax collection | Pakistan (Domestic) | Invoice reference, PKR amount, customer contact, 1Link/Raast/card authorization | PCI-DSS Level 1 compliant, 3D Secure 2.0, State Bank of Pakistan regulated rails | Statutory fiscal bookkeeping requirements under Pakistani financial laws |
Vercel Web Analytics Vercel Inc. (Delaware, USA) | Analytics (Opt-In) Aggregated performance telemetry and Core Web Vitals optimization | USA / Global Edge | Anonymized page views, device resolution, Core Web Vitals (LCP, CLS, FID) | IP addresses automatically discarded before storage; cookieless or gated by consent | Up to 90 days aggregated metrics |
Google Analytics 4 Google LLC (Delaware, USA) | Analytics (Opt-In) Opt-in visitor traffic insights and conversion metrics | USA | Anonymized URL paths, general device parameters (screen resolution, OS) | Strict IP anonymization enabled; strictly gated by user cookie consent | Configured to minimal 2-month retention window |
Subprocessor Engagement & Due Diligence Standards
SBF Consultancy performs strict security, legal, and cryptographic reviews before engaging any third-party subprocessor. Each subprocessor must provide audited SOC 2 / ISO 27001 certifications, enter into legally binding Data Processing Agreements (DPAs) incorporating standard contractual clauses, and enforce strict Zero-Data-Retention (ZDR) terms for all AI inference workloads. Subprocessors are prohibited from aggregating customer prompts or using customer data to train artificial intelligence models.