Consus, a One-Person YC Company, Sells an ITAR LLM Gateway at $40 a Seat

Consus, a one-person Y Combinator Fall 2024 company, launched an LLM gateway on Hacker News this week that routes requests for aerospace and defense contractors to government-grade cloud regions, for a compliance fee starting at $40 a month per seat plus model tokens at cost.

The product is real enough to have a docs site, but access is not self-serve. The Launch HN post says customers sign a contract before they receive API keys. Y Combinator's company page lists Eric Magliarditi as founder and chief executive, a team of one and a base in San Francisco. The post, written under the username ericmags, says the founder previously worked in aerospace and defense, including at SpaceX and Castelion. No funding round appears in either document.

What the gateway does

Consus exposes a single OpenAI-compatible endpoint. Every request must carry a compliance suffix on the model name, such as gpt-5.6-sol:fedramp-high, and a bare model name is rejected. Organizations set model allowlists and per-user spend limits through a portal. The post says Consus does not proxy to ordinary commercial endpoints, and that it keeps metadata for billing and audit while enforcing zero data retention on itself and its upstream model providers.

The post names one exception: on AWS, abuse monitoring still applies to some flagged requests, which may be kept for up to 30 days. Consus's compliance page names AWS GovCloud, Azure Government and GCP Assured Workloads as the infrastructure.

What the compliance page claims, in its own words

ITAR, the US export-control regime for defense technical data, is listed as "Satisfied", and the same page says "No ITAR certification exists; companies self-certify." Both statements are on it. The first is a status, the second is the reason the status cannot be independently checked.

The firmer claim is FedRAMP equivalency, which the page says was assessed by "our 3PAO against all 410 FedRAMP High controls." A 3PAO is a third-party assessment organization, and the page does not name it. SOC 2 is marked in progress, DoD Impact Level 5 is marked roadmap with application-layer authorization called "future work", and Consus says it is not a CMMC certification holder.

One commenter on the thread asked whether an independent assessment covered all 410 controls or an internal mapping did. The visible replies do not answer it.

Claim	Consus	TrueFoundry
Deployment	Hosted gateway on GovCloud, Azure Government, GCP Assured Workloads	On-premises or private VPC
Assessor named	No, "a FedRAMP-recognized 3PAO"	No
ITAR wording	"Satisfied", with no certification existing	"ITAR-compliant AI Gateway deployments"

Who else sells this

The Launch HN post compares the product to OpenRouter for integration breadth, and to Bedrock in AWS GovCloud and Azure Government. One commenter linked gluondb.com as a similar product and another called the space crowded.

The nearest dated competitor in the sources is TrueFoundry, which on Sept. 10, 2026 announced what it calls ITAR-compliant gateway deployments that stay inside customer-controlled infrastructure, with no shared control plane. Its announcement names no assessor and never uses the word certified. That is the architectural difference: TrueFoundry ships into the customer's environment, while Consus asks the customer to send data to its hosted gateway and trust the audit.

Other limits surfaced in the thread. HIPAA business associate agreements are not set up. One commenter said that coding agents, MCP servers and web fetches can move data outside any gateway, and the founder said customers get guidance during onboarding and that tool allowlisting is planned. A question about air-gapped deployment went unanswered in the visible thread.

The numbers that would settle it

At $40 a seat, a 50-person engineering team pays $2,000 a month before tokens. The price is small next to the cost of a failed audit, which is why the 3PAO's name, its report date and its scope are the details a buyer should ask for. The post had 36 points on Hacker News when this article was reported. A FedRAMP High assessment held by a one-person company is, for now, a claim on a web page; no FedRAMP listing or assessment report was among the sources read.

Another YC-backed infrastructure launch covered here, Agent37's agent sandboxes, sells at $4.76 a month, which shows how far the compliance premium sits from ordinary agent hosting. A different Hacker News launch drew a flood of bot traffic that robots.txt did not stop. The next observable event is whether Consus names its assessor or publishes the assessment summary.