Consus, a YC F24 Startup, Sells an ITAR LLM Gateway From $40 a Seat While a Rival Runs Inside the Customer's Cloud

Consus, a Y Combinator Fall 2024 company, launched an LLM gateway for aerospace and defence firms on Hacker News this week. It had 36 points when the lead sheet was drawn on October 17. The company charges a compliance fee from $40 a seat a month, plus model tokens at cost.

The founder posts as ericmags and gives only the first name Eric. He says he previously launched national security payloads at SpaceX and was an early employee at Castelion. The post names no customers beyond saying the company is actively serving some.

How the gateway works

Every request goes to one OpenAI-compatible endpoint, where keys are checked and policy applied before inference. Model names must carry a compliance suffix. The post's examples are gpt-5.6-sol:fedramp-high and claude-opus-5-5:itar, and a bare model name is rejected.

Customers set model allowlists and per-user spend limits in a web portal. Consus says it stores no prompts or completions and keeps request metadata for billing and audit. It is not self-serve: organisations are vetted and sign a contract before getting keys.

The founder's former employer, shown above, is not named as a Consus customer in the post.

What the thread left open

The strongest claim is a FedRAMP equivalency audit against the 410 FedRAMP High controls. A commenter asked whether that was an independent assessment or an internal control mapping, and whether documentation is public. The thread as retrieved shows the question and no answer.

On retention, the founder said AWS's abuse classifier can keep flagged requests for up to 30 days and that Consus is still turning that off. For a product sold on ITAR and controlled unclassified information, that is the line a procurement officer will read first. HIPAA business associate agreements are not in place. Commenters also asked about dedicated encryption keys, air-gapped deployment and coding-agent leakage outside the gateway; the thread shows no reply on the first two, and the founder said tool and MCP controls are planned.

The rival that runs in your own cloud

TrueFoundry announced on September 10 what it called the first AI gateway with ITAR compliance. Its design is the opposite of a hosted endpoint: the customer runs it on-premises or in a private VPC, with no shared control plane.

	Consus	TrueFoundry
Announced	Launch HN, October 2026	September 10, 2026
Where it runs	One hosted endpoint	Customer's VPC or on-premises
Price shown	From $40 a seat a month	Not on the page
Compliance evidence	Self-described FedRAMP equivalency audit	ITAR-aligned access controls and audit logs

Both compliance descriptions come from the vendors. Neither page links an independent assessor's report.

What to watch

Other infrastructure startups we have covered include Agent37 and Modal. Consus has not said how much it has raised or who its customers are. The next checkable item is whether it publishes the FedRAMP audit documentation a commenter asked for. Until it does, the 410-control figure is a claim, and a hosted gateway that sends ITAR data through a third-party model provider has a shorter list of defences than one running inside the customer's cloud.