Every API call dispatched to an external Large Language Model (LLM)—whether OpenAI in us-east-1 or Anthropic across shared US multi-tenant infrastructure—operates as an unmonitored egress pipe. When an internal application service ships an HTTP payload containing customer identifiers, bank account numbers, or confidential operational logic to external SaaS endpoints, the enterprise crosses the statutory boundary established by Indonesia’s Personal Data Protection Law (UU No. 27/2022, or UU PDP).
Article 56 of UU PDP treats prompt dispatches to overseas servers as statutory cross-border transfers of personal data. In the absence of certified jurisdictional data-protection equivalence or formal bilateral data transfer agreements, standard SaaS clickwrap terms of service do not satisfy Indonesian regulatory mandates. Furthermore, multi-tenant logging, telemetry collection, and external model caching create uncontrolled attack surfaces that expose corporate data controllers to administrative fines of up to 2% of annual turnover (Article 57) and criminal penalties (Articles 65–67).
Solving this compliance bottleneck without sacrificing generative AI throughput requires treating regulatory boundaries as system architecture constraints. By deploying containerized, open-weights models inside an air-gapped Virtual Private Cloud (VPC) located in AWS Jakarta (ap-southeast-3), engineering teams retain complete computational sovereignty, sub-millisecond network hops, and complete control over data retention.
+----------------------------------------------------------------------------------------------------+
| AWS Virtual Private Cloud (10.100.0.0/16) - Jakarta Region (ap-southeast-3) |
| |
| [ Public Subnet ] (Egress Filter Only) |
| +-----------------------------+ |
| | NAT Gateway (No Public IP | ---> Internet (Strict Egress Filter: PyPI / Internal Registry) |
| | Ingress, Egress Allow-list) | |
| +-----------------------------+ |
| |
| [ Private Subnet 1 (10.100.1.0/24) ] |
| +------------------------+ mTLS (x509) +----------------------------------------+ |
| | Internal Application | ------------------------> | Envoy API Gateway (Ingress Proxy) | |
| | Services (Core Banking)| | - SPIFFE Authentication | |
| +------------------------+ | - Rate Limiting & AuthZ | |
| +----------------------------------------+ |
| | |
| v |
| [ Private Subnet 2 (10.100.2.0/24) ] |
| +----------------------------------+ Internal HTTP +----------------------------+ |
| | Ingestion & PII Redaction Worker | --------------------------> | vLLM Inference Engine | |
| | - Regex / NER Tokenization | | - Model: Gemma-2-27b-it | |
| | - HMAC Pseudonymization | | - AWQ Quantization (int4) | |
| +----------------------------------+ | - Dedicated GPU Memory | |
| | +----------------------------+ |
| v Local Embedding / Retrieval (gRPC) |
| +----------------------------------+ |
| | Qdrant Vector Search Engine | |
| | - BAAI/bge-m3 Embeddings | |
| | - Encrypted EBS NVMe Volume | |
| +----------------------------------+ |
+----------------------------------------------------------------------------------------------------+1. Statutory Constraints as System Specifications
Rather than treating UU PDP as an abstract legal exercise, we translate statutory mandates into three concrete technical invariants:
Invariant A: Absolute Egress Null-Routing (Article 56)
All inference workloads must execute on hardware physically provisioned within Indonesian borders. In the AWS Jakarta region (ap-southeast-3), compute subnets have no default route (0.0.0.0/0) to an Internet Gateway. Outbound connections are confined to internal VPC endpoints and private registry mirrors via an egress-filtering proxy. Prompts never traverse the public internet.
Invariant B: Zero Persistent Prompt Telemetry (Article 46)
Public LLM APIs routinely capture request bodies for telemetry, abuse monitoring, or offline distillation. Under Article 46, any unauthorized retention or security breach involving personal data triggers a mandatory 3x24-hour notification clock to regulators and data subjects. Running self-hosted inference runtimes with standard stdout logging disabled guarantees that prompts exist solely in volatile GPU SRAM during forward token generation.
Invariant C: Cryptographic Identity & Micro-Segmentation
All internal API callers must present x509 cryptographic identities validated via SPIFFE/SPIRE over mutual TLS (mTLS). Ingress proxy Envoy authenticates microservice callers, enforces per-tenant rate limits, and strips downstream transport headers before routing payloads to the inference worker.
2. Air-Gapped VPC Architecture
The architecture partitions responsibilities across isolated subnets to ensure defense-in-depth:
- Ingress Boundary & Envoy Gateway: Core application services connect to the inference cluster via an internal Envoy proxy. Plain HTTP traffic is rejected at the subnet security group level.
- Deterministic Ingestion & PII Redactor: Payloads pass through an in-memory tokenization layer that strips national identity numbers (NIK), tax IDs (NPWP), phone numbers, and bank account sequences before reaching vector stores or model contexts.
- Local Vector Search: Semantic context is generated on-box using
BAAI/bge-m3embeddings and stored in a private Qdrant cluster backed by NVMe storage encrypted via AWS KMS Customer Managed Keys (CMK). - Hardware-Accelerated Inference: Google Gemma 2 27B executes on a single dedicated 24GB NVIDIA A10G instance utilizing AWQ 4-bit tensor quantization.
3. Production vLLM Deployment on NVIDIA A10G
Running enterprise LLM inference cost-effectively requires maximizing tokens-per-second per dollar while staying within single-GPU memory envelopes. Standard FP16 weights for a 27-billion parameter model demand ~54GB of VRAM, requiring costly multi-GPU rigs (such as 2x A100 or 4x A10G).
By utilizing Activation-aware Weight Quantization (AWQ) at 4-bit precision, the model weight footprint is compressed to ~16GB. On a standard 24GB NVIDIA A10G instance (such as AWS g5.2xlarge), this preserves 8GB of contiguous VRAM exclusively for the KV cache. Using vLLM with PagedAttention, this configuration comfortably maintains 64 concurrent generation sequences across an 8,192-token context window with sub-120ms time-to-first-token (TTFT).
# docker-compose.vllm.yml
version: "3.8"
services:
vllm-gemma:
image: vllm/vllm-openai:v0.6.3
container_name: gemma-2-27b-isolated
restart: unless-stopped
runtime: nvidia
environment:
- CUDA_VISIBLE_DEVICES=0
- NCCL_DEBUG=WARN
- VLLM_LOGGING_LEVEL=WARNING
ports:
- "127.0.0.1:8000:8000"
volumes:
- /opt/models/gemma-2-27b-it-awq:/models/gemma-2-27b-it-awq:ro
- /opt/huggingface-cache:/root/.cache/huggingface:ro
command: >
vllm serve /models/gemma-2-27b-it-awq
--host 0.0.0.0
--port 8000
--model /models/gemma-2-27b-it-awq
--quantization awq
--dtype half
--gpu-memory-utilization 0.92
--max-model-len 8192
--max-num-seqs 64
--disable-log-requests
--enforce-eager
deploy:
resources:
reservations:
devices:
- driver: nvidia
count: 1
capabilities: [gpu]
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
interval: 10s
timeout: 5s
retries: 3Critical Flag
--disable-log-requests: Standard vLLM instances print incoming prompt strings directly to container logs. If your platform forwards container stdout to centralized collectors (Elasticsearch, CloudWatch, Datadog), sensitive financial or customer identifiers will leak into unencrypted log storage. Enforcing--disable-log-requestsguarantees that raw prompt text exists solely in volatile GPU memory and is never written to disk or container output streams.
4. In-Memory PII Tokenization Pipeline
To guarantee that vector indices and intermediate model activations never store cleartext identifiers, all prompt text passes through a deterministic redaction pipeline before tokenization.
The pipeline identifies Indonesian statutory data structures—including 16-digit Nomor Induk Kependudukan (NIK), Nomor Pokok Wajib Pajak (NPWP), phone numbers, and bank account strings—and substitutes them with HMAC-derived tokens. The mapping dictionary remains in volatile memory on the ingestion worker and is never written to persistent storage.
// pii-sanitizer.ts
import { createHmac } from 'crypto';
interface RedactionResult {
sanitizedPrompt: string;
replacementMap: Record<string, string>;
}
export class IndonesianPiiRedactor {
private readonly secretKey: Buffer;
// Regex patterns conforming to Indonesian statutory identification schemas
private readonly patterns = {
// Nomor Induk Kependudukan (NIK): 16 consecutive digits
nik: /\b([1-9][0-9]{15})\b/g,
// Nomor Pokok Wajib Pajak (NPWP): XX.XXX.XXX.X-XXX.XXX or 15/16 raw digits
npwp: /\b(\d{2}\.\d{3}\.\d{3}\.\d{1}-\d{3}\.\d{3}|\d{15,16})\b/g,
// Indonesian Cellular Format: +62 8XX or 08XX (10-13 digits)
phone: /\b(\+62|62|0)(8[1-9][0-9]{7,10})\b/g,
// Bank Account Numbers: 10-16 consecutive numeric sequences
bankAccount: /\b([0-9]{10,16})\b/g,
};
constructor(secretKey: string) {
this.secretKey = Buffer.from(secretKey, 'utf-8');
}
private generateToken(type: string, rawValue: string): string {
const hash = createHmac('sha256', this.secretKey)
.update(rawValue)
.digest('hex')
.slice(0, 10);
return `[${type}_REDACTED_${hash}]`;
}
public redact(rawInput: string): RedactionResult {
let sanitized = rawInput;
const replacementMap: Record<string, string> = {};
// 1. Redact NIK
sanitized = sanitized.replace(this.patterns.nik, (match) => {
const token = this.generateToken('NIK', match);
replacementMap[token] = match;
return token;
});
// 2. Redact NPWP
sanitized = sanitized.replace(this.patterns.npwp, (match) => {
const token = this.generateToken('NPWP', match);
replacementMap[token] = match;
return token;
});
// 3. Redact Indonesian Phone Numbers
sanitized = sanitized.replace(this.patterns.phone, (match) => {
const token = this.generateToken('PHONE', match);
replacementMap[token] = match;
return token;
});
return {
sanitizedPrompt: sanitized,
replacementMap,
};
}
public restore(inferenceOutput: string, replacementMap: Record<string, string>): string {
let restored = inferenceOutput;
for (const [token, originalValue] of Object.entries(replacementMap)) {
restored = restored.replaceAll(token, originalValue);
}
return restored;
}
}The model reasons over the synthetic replacement tokens (e.g. [NIK_REDACTED_a89fbc01de]) preserving syntactic dependencies and contextual flow. Once the completion generation terminates, the worker rehydrates the original identifiers before returning the HTTP response over mTLS to the verified caller.
5. Architectural Verification & Compliance Guarantees
This architecture transforms statutory compliance from an ambiguous legal risk into an audited engineering reality:
- Sovereign Physical Enclosure: Compute and storage reside strictly within AWS Jakarta (
ap-southeast-3). Egress routes to public LLMs are eliminated at the routing table level. - Zero Third-Party Model Retraining: Eliminating commercial API subscriptions prevents enterprise data from being used in external model evaluation or safety training pipelines.
- Hardware Isolation: Dedicated GPU instances eliminate multi-tenant memory bleed and hypervisor side-channel attacks. Model weights and KV cache reside strictly in host memory owned by the organization.
- Forensic Audit Readiness: API access telemetry captures cryptographic caller identity, timestamp, and token consumption metrics while omitting prompt payloads, satisfying statutory audit demands without creating secondary PII liabilities.
By decoupling generative AI capabilities from public cloud API dependencies, engineering teams deliver modern enterprise intelligence with mathematically verifiable sovereignty.