You bring the AI key; Compass provides the compliance harness. That is the BYOK model: your own API credentials for OpenAI, Anthropic, or DeepSeek — or a local model running on your machine with zero network egress.
What BYOK Changes — You Own the Key
Most AI compliance tools lock you into the vendor's chosen model and pricing. The provider decides which model is behind the interface, what it costs per token, and where inference happens.
BYOK inverts that. You supply the API key, or you point Compass at a local model running through Ollama, LM Studio, or MLX. Compass does not mark up the token cost, does not route through a cloud tier, and does not force a single provider. The API key you bring is used directly — or not at all if you run local.
For trust professionals who handle sensitive policies, risk registers, and evidence artifacts, the practical difference is this: your data and your inference are covered by your own commercial agreement with the provider, not by a hidden sub-processing chain. When you run local, there is no network call at all.
When to Run Local vs. a Frontier API
Neither approach is always right. The choice depends on the task, the data, and the available hardware.
| Scenario | Local model | Frontier API |
|---|---|---|
| Working with sensitive evidence offline | Best — zero egress, air-gap capable | Not applicable |
| Drafting routine policies from templates | Good — commodity models handle this well | Better — higher-quality output on first draft |
| Reviewing a 200-question security questionnaire | Slower on consumer hardware | Fast — frontier models process long documents efficiently |
| Air-gap or classified environments | Only option | Not permitted |
| Team on a tight API budget | Near-zero model cost | Per-token billing under your own key |
| Getting the best possible output for an audit memo | Adequate with larger local models | Strong with GPT-4o, Claude 4 Sonnet, DeepSeek |
The pattern: local models cover daily drafting, evidence review, and template work without incurring a per-task cost. Frontier APIs add speed and quality headroom for complex, high-stakes artifacts.
Switching Providers Without Switching Tools
Model-agnostic design means your workspace, artifacts, and templates travel with you when you change providers. Update one setting — the API endpoint and key — and Compass routes all agent work through the new provider. No migration. No retraining. No export-and-import.
The AI model market is moving fast. A provider that leads on compliance-document quality today may be surpassed next quarter. A pricing change may push costs where you did not plan. With BYOK, neither scenario forces a tooling decision. Switch the key and keep working.
The same applies when dedicating certain work to local models and other work to APIs. Compass does not enforce a single provider per workspace. Point drafting tasks at a local Ollama instance and save frontier API calls for complex cross-framework mapping.
Choosing Which Model Reads Which Document
Not every compliance artifact needs the same model. A quick evidence summary from a known template works well on a small local model. Drafting a risk-treatment proposal for leadership benefits from a larger frontier model that reasons across multiple sources.
Practical heuristics:
- Policy drafts from existing templates: local model (Llama 3, Qwen, Mistral) — the template constrains output, so raw reasoning capacity matters less.
- Cross-framework control mapping: frontier API (GPT-4o, Claude 4 Sonnet) — requires cross-referencing multiple framework texts and identifying equivalences.
- Evidence summaries: local model — factual extraction from specific documents, low hallucination risk when grounded.
- High-stakes customer questionnaire answers: frontier API — better handling of edge cases and implied requirements.
- Risk register population: either — depends on the complexity of your risk taxonomy.
The harness — hallucination catching, fabrication blocking, citation enforcement — applies regardless of which model is answering. A local model does not bypass it, and a frontier API does not become less safe because it is more capable.
FAQ
Do I need an API key to use Compass? No. You can run entirely on local models through Ollama, LM Studio, or MLX. Compass works offline with no network calls. An API key is only required when you want to use a cloud provider's model.
Does Compass add a markup on API costs? No. Your key is used directly. Compass has a flat per-seat fee that covers the application and harness. What you pay in API usage is what the provider charges you.
Can I use different models for different tasks in the same workspace? Yes. Compass is model-agnostic per workspace. Configure which provider or local endpoint handles which type of artifact — see the local vs. frontier comparison for guidance on task-model fit.
What happens if my local model gives a low-quality answer? The harness still applies — citations are required, unsupported claims are flagged as "Not Provided / no source found." The output quality ceiling depends on the model, but the floor is set by the harness. Switch to a frontier API for that specific task when needed.
Is there vendor lock-in if I start with one provider? No. Switching providers is a configuration change. Workspace artifacts are stored in local SQLite — no provider-specific formatting, no export fee.
The Compass Close
When the model you bring reads your evidence and drafts an artifact, every claim carries a citation to its source. The harness catches unsupported answers and marks them as "Not Provided / no source found" instead of fabricating a response. In Compass by Truvara, the agent reads your workspace, drafts against your key, and proposes changes for your review. The boundary is honest: output quality still depends on the model you bring — the harness ensures output is grounded, not that it is perfect. Join the waitlist to see what your model can do in a compliance harness built for trust work.