EU inference

EU inference is an optional organization setting. When it is on, heyGRC sends that org's compliance reviews (the GRC reviewer on pull requests) to Mistral on the EU regional endpoint. The default product path stays on vetted global providers. US and EU teams both use the default path unless they turn this on.

This page is the customer how-to. Binding legal documents stay on the ISMS Copilot trust center. Product narrative: heygrc.com/trust.

What changes when it is on

• Reviews for that org go to Mistral (api.eu.mistral.ai), not the default global model path.
• There is no silent fallback. If the EU model is unreachable, the review fails rather than using a non-EU model.
• Quality and style can differ from the default reviewer. Very large pull requests use a smaller review budget and may be marked partial more often.
• Successful EU reviews include a footer line: Inference: EU (Mistral).
• Credits and plan limits are the same as the default path. The setting is available on all plans, including Free.

What does not change

• The review worker already runs in Paris. That is the job queue and GitHub API control plane, not the same claim as EU inference.
• GitHub remains the source of pull request content (US). Stripe billing stays where it is today.
• Default orgs (EU inference off) keep the existing global path.

How to turn it on

1. Open the console: app.heygrc.com → Settings.
2. Find the EU inference card.
3. Confirm the dialog (residency, quality tradeoff, fail-closed, smaller large-PR budget).
4. Save. New reviews for that org use the EU path.

Turn it off the same way to return to the default global path.

Configure it as code

eu_inference is a sticky field on GET / PUT /v1/config. Omitting it on PUT leaves the current value unchanged. See API reference.

curl -sS -X PUT https://api.heygrc.com/v1/config \
  -H "Authorization: Bearer $HEYGRC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"profile":{"company":"Acme"},"frameworks":["ISO_27001","SOC_2","GDPR"],"eu_inference":true}'

Replace profile and frameworks with your real org config. A PUT is full-replace for those fields; only eu_inference is sticky when omitted.

Honesty notes

• This is inference region, not "all data stays in the EU." GitHub, email, and billing are separate.
• Do not treat a dark flag or an internal design doc as a promise. If the toggle is in your console, the platform path is enabled.

Related

• Security and data
• Console and API keys
• API reference
• heygrc.com/trust