The question behind the question
An audit does not ask whether you use a tool. It asks what happened to one particular piece of content on the 14th of a month. That is a question for a record, not for a product description.
What gets documented
Per the operator handbook: every routing decision is documented — local or cloud, the reason, the flags that led to it. Audit logs are immutable, so they cannot be altered afterwards. And: no PII in the logs.
That last point is not a limitation but the purpose. A record that copies the sensitive content in order to evidence its protection is a second leak.
What is deliberately not in there
- The prompt in cleartext. See above.
- In ephemeral mode, even the decision carries no content. There the log records the routing decision only; the user sees a note in the chat that nothing is stored.
- What the provider does after receiving it. What is provable is what the model received. What happens afterwards in someone else's infrastructure cannot be witnessed by a record on your side.
Why that is the difference
Others move the inspection into your environment. The point is to move the evidence: classification, masking and the routing decision are logged at the boundary and are exportable. A perimeter you cannot evidence is not one.
A note on honesty. This page describes what the operator handbook assures: documented decisions, immutable logs, no PII. No stronger cryptographic assurances are claimed here.