Guide
Using an AI coding agent on export-controlled code.
Teams with export-controlled source code have to know where every byte of it goes. This guide sets out the questions to work through with your export-compliance lead, and what Topsoil does and does not do. It is not legal advice.
Start with your compliance lead
Whether a tool can be used with controlled technical data is your organisation’s determination, made with its export-compliance function. Topsoil does not make an environment compliant and does not make that decision for you. What it can do is keep the path your code takes short and documented.
Questions to work through
- Where does inference happen? In which AWS account and region, and is that region approved for this data?
- Who operates each hop? List every service between the developer’s machine and the model.
- What is stored, and where? Prompts, context files, indexes, logs and chat history.
- Who can sign in? Which identities, from which machines, and how access is reviewed.
- What leaves the machine besides model calls? Telemetry, crash reports, updates, fonts or CDN fetches.
How Topsoil answers them
| Question | Topsoil |
|---|---|
| Where inference happens | The Amazon Bedrock, custom HTTPS or gateway endpoint you configure, in your AWS account, commercial or AWS GovCloud (US) |
| Who operates each hop | You and AWS. There is no Thazen-operated service in the path |
| What is stored | Chats and credentials on the machine; the context library and budget policy in your S3 bucket under per-user prefixes; invocation logs only if your account enables them |
| Who can sign in | The IAM, profile or IAM Identity Center identities you grant |
| What else leaves the machine | Nothing to Thazen: no telemetry, analytics, crash reporter or font or CDN fetch; updates come from your own bucket where configured |
AWS states that AWS GovCloud (US) Regions are administered exclusively by AWS personnel who are U.S. citizens, to help customers manage obligations under U.S. export control regimes. Read AWS’s own page for the details and for your side of the shared-responsibility model.
See it against your own codebase.
A pilot runs in your own AWS account, with your models and your material, and ends with findings you can act on.