Professionals bound by secrecy (§ 203 StGB)

Lawyers, tax advisors, doctors and other professionals bound by secrecy are subject to the duty of confidentiality under § 203 German Criminal Code (StGB). If your organisation counts as bound by secrecy, the gateway forwards requests only to providers marked as § 203 covered in the catalogue. This page describes the technical effect: which providers drop out and how this shows in the model list and in errors.

Status of a provider

Every provider in the catalogue carries one of three values. For providers managed by Noirdoc, the portal shows it as a badge.

Only covered passes the check. on_request is for display only; the gateway treats the provider like none. Your own providers (BYOK) carry none by default.

Organisation mode

If your organisation counts as bound by secrecy, the gateway excludes all providers managed by Noirdoc that are not covered. This mode does not exclude your organisation’s own providers (BYOK).

The mode applies to all keys of the organisation. To set it, admins answer the question on the portal’s Getting started page whether the organisation is subject to the duty of confidentiality under § 203 StGB. Until they answer, the mode is active. Switching it off later requires an explicit confirmation.

The check selects providers; it does not switch off storage at the provider. Whether a managed provider may keep input and response after answering is governed by the Allow Responses API storage at provider option under Models → Shield in Advanced Settings, see Responses. If it is switched on, the provider keeps the content for 30 days after answering; the portal points this out to organisations in professional-secrecy mode at that point.

Restriction per key

Independently of the organisation, a single key can carry the restriction Only §203-covered providers. Admins set it under Models → API keys.

This restriction is stricter: it applies to all providers, including your own providers (BYOK). Your own provider passes it only if it is marked as covered. The portal offers no setting for this marking on your own providers.

Effect on the model list and routing

The gateway applies the same check wherever it selects providers:

• GET /v1/models lists only models for which at least one provider passes the check. A model that is available only from excluded providers is missing from the list.
• For a request, only providers that pass the check are eligible. If several providers offer the model, the gateway chooses among the remaining ones as described in Providers & routing.
• Failover, too, goes only to providers that pass the check.
• The same applies to endpoints without a model ID, such as /v1/files.

Errors

If an application requests a model whose providers are all excluded, the gateway answers with status code 403. The error code shows which level excluded the provider:

provider_not_allowed_for_tenant comes from the organisation mode. The error code refers to your organisation, not to the key.

{
  "error": {
    "type": "permission_error",
    "code": "provider_not_allowed_for_tenant",
    "message": "'<model-id>' is not permitted for this …",
    "param": null
  }
}

provider_not_allowed_for_key comes from the key’s restrictions. Besides § 203, another restriction of this key may also have excluded the provider, such as data residency or allowed providers.

In both cases, choose a model from GET /v1/models. With the organisation mode, you can also connect your own provider for the model under Models → Providers. With the key restriction, check its settings under Models → API keys; the steps are shown in Restrict models & providers.